Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.20
- 9.x: All versions from 9.0.3 up to and including 9.4.5
Kibana 9.5.0 and later release lines are not affected because the vulnerable Entity Store v1 administrative surface was removed.
Affected Configurations:
Deployments where the Kibana Security Solution is in use and the Entity Store feature is available. Entity Store requires a Platinum subscription or higher on Elastic Stack, or the Security Analytics Complete project feature tier on Elastic Cloud Serverless. Deployments that do not meet these subscription requirements and therefore cannot enable Entity Store are not exposed to this vulnerability.
Solutions and Mitigations:
The issue is resolved in Kibana versions 8.19.21 and 9.4.6.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE ID: CVE-2026-78597
Problem Type: CWE-862 - Missing Authorization
Impact: CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs