Incorrect Authorization in Kibana Leading to Privilege Escalation
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.20
- 9.x:
- All versions from 9.0.0 up to and including 9.4.5
- All versions from 9.5.0 up to and including 9.5.2
Affected Configurations:
All Kibana deployments where the Fleet feature is enabled and one or more Elastic Agents are enrolled. This includes default deployments, as Fleet is enabled by default in Kibana.
Solutions and Mitigations:
The issue is resolved in Kibana versions 8.19.21, 9.4.6, and 9.5.3.
For Users that Cannot Upgrade:
Restrict Kibana Fleet integration management and agent policy management privileges to fully trusted users only. Exploitation requires both privileges to be held simultaneously, so reducing the set of principals holding them limits who can trigger the condition. This does not remove the underlying vulnerability.
Indicators of Compromise (IOC)
Administrators can audit the compiled permissions of agent policies, and the policy documents distributed to Fleet Server, to identify any entry where the cluster privilege set for an integration extends beyond monitoring-level access. Any installed integration package declaring cluster privileges beyond those required for routine agent telemetry ingestion should be treated as suspicious and its provenance verified. Affected agents should have their credentials revoked and reissued after upgrading.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 8.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVE ID: CVE-2026-78583
Problem Type: CWE-863 - Incorrect Authorization
Impact: CAPEC-153 - Input Data Manipulation