Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.
Affected Versions:
- All versions from 9.4.0 up to and including 9.4.3
The 8.x release line is not affected because the vulnerable code path was introduced in 9.4.0 and is not present in earlier major versions.
Affected Configurations:
Kibana deployments with the Osquery feature enabled and multiple Kibana spaces configured are affected by this vulnerability.
Solutions and Mitigations:
The issue is resolved in Kibana version 9.4.4.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE ID: CVE-2026-78584
Problem Type: CWE-204 - Observable Response Discrepancy
Impact: CAPEC-54 - Query System for Information