CVE-2026-78608: Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Kibana user can exploit it. The affected internal APM integration function does not enforce the APM or Fleet administrative privileges that should restrict access to APM server credentials.
What information could be exposed?
An attacker could read APM server credentials. The provided impact information indicates confidentiality impact is high, with no stated integrity or availability impact.
Does exploitation require user interaction or complex conditions?
No user interaction is required, and the attack complexity is rated low. The attacker does need an authenticated Kibana account with low-level privileges.