High severity8.1NVD Advisory· Published Sep 3, 2026· Updated Sep 8, 2026
CVE-2026-78583
CVE-2026-78583
Description
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versions
>= 8.0.0, < 8.19.21+ 1 more
- (no CPE)range: >= 8.0.0, < 8.19.21
- (no CPE)range: >= 8.0.0, < 8.19.21
Patches
Vulnerability mechanics
References
1- discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-140/390158nvdVendor AdvisoryMitigation
News mentions
1- Elastic Kibana: 25 Authorization and Resource Management Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 3, 2026