CVE-2026-78597: Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kibana user with only low-privilege access to the Security feature may be able to exploit it. No user interaction is required.
What does successful exploitation allow?
The attacker can invoke an administrative Entity Store operation to create and persist Elasticsearch API keys under their own identity. This bypasses the elevated cluster and Kibana privileges required by the documented Entity Store setup flow.
Are unauthenticated users affected?
No. The supplied severity vector specifies that privileges are required, and the description identifies the attacker as an authenticated user.