Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.20
- 9.x:
- All versions from 9.0.0 up to and including 9.4.5
- All versions from 9.5.0 up to and including 9.5.2
Affected Configurations:
Kibana deployments where the Cribl integration has been installed. The vulnerability is exploitable only by authenticated users who hold the Kibana Fleet management (fleet:all) privilege.
Solutions and Mitigations:
The issue is resolved in versions 8.19.21, 9.4.6, 9.5.3.
For Users that Cannot Upgrade:
Restrict the Kibana Fleet management (fleet:all) privilege to trusted administrators only, reviewing all roles that grant this privilege and removing it from any role assigned to untrusted users. If the Cribl integration is not actively required, removing the integration from the deployment eliminates the vulnerable code path entirely.
Indicators of Compromise (IOC)
Administrators can inspect Elasticsearch ingest pipeline configurations associated with the Cribl integration for routing conditions that differ from their expected or originally configured state. Kibana audit logs may reveal Fleet package policy creation activity performed by accounts whose privilege level would not ordinarily warrant such operations.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium (4.3) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE ID: CVE-2026-78593
Problem Type: CWE-94 - Improper Control of Generation of Code ('Code Injection')
Impact: CAPEC-242 - Code Injection