Kibana CVE-2026-7860 Missing Authorization (CWE-862) Security Update (ESA-2026-147)

Kibana 9.4.5 Security Update (ESA-2026-147) Vulnerability Overview Vulnerability Name: Missing Authorization (CWE-862) in Kibana, which can lead to leakage of Elasticsearch index data through Privilege Abuse (CAPEC-122). Problem Description: The Kibana Entity Store configuration operations lack authorization controls. Kibana users with higher privileges can trigger background tasks to read Elasticsearch indexes, thereby gaining indirect access to data they do not normally have permission to access; the derived entity data is then exposed via the Entity Store output. Severity: CVSSv3.1 Medium (5.5) — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/H:I:L/A:N CVE ID: CVE-2026-7860 Issue Type: CWE-862 - Missing Authorization Impact: CAPEC-122 - Privilege Abuse Indicators of Compromise (IOC): No specific Indicators of Compromise have been identified in relation to this vulnerability. Affected Scope Affected Versions: 9.x: 9.4.0 through 9.4.4 (inclusive). Unaffected: Versions prior to 9.4.0 (including all 8.x versions) are not affected, as the affected component did not exist in those versions. Affected Configurations: Kibana deployments meeting all of the following conditions are affected: - A Gold or Enterprise subscription (or equivalent trial license) is active; - The Entity Store v2 feature has been enabled by an administrator; - The Entity Store has been installed at least once. - Deployments that do not meet all of the above conditions are not affected. Elastic Cloud Serverless: Due to the continuous deployment and patching model, this vulnerability has been re-released in Elastic Cloud Serverless. Remediation Solution: This issue is fixed in Kibana version 9.4.5. Users Unable to Upgrade: There are no available workarounds for this vulnerability. POC / Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana CVE-2026-7860 Missing Authorization (CWE-862) Security Update (ESA-2026-147)