CVE-2026-26939: Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26939?
The severity of CVE-2026-26939 is classified as high due to potential unauthorized endpoint response actions.
How do I fix CVE-2026-26939?
To fix CVE-2026-26939, update to the latest version of Kibana where the vulnerability has been addressed.
What systems are affected by CVE-2026-26939?
CVE-2026-26939 affects Elastic Kibana installations, specifically related to its server-side Detection Rule Management.
What can be exploited in CVE-2026-26939?
CVE-2026-26939 can be exploited to configure unauthorized endpoint response actions such as host isolation and process termination.
How does CVE-2026-26939 impact Kibana security?
CVE-2026-26939 compromises Kibana security by allowing attackers to potentially manipulate detection rule actions without proper authorization.