CVE-2026-78593
published 2026-09-03CVE-2026-78593: An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.29%
20.7th percentile
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | 8.0.0 – 8.19.20 | — |
| elastic | kibana | 9.0.0 – 9.4.5 | — |
| elastic | kibana | 9.5.0 – 9.5.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 8.19.20/9.4.5/9.5.2 Cribl Integration privileges management
vuldb·2026-09-03·CVSS 4.3
CVE-2026-78593 [MEDIUM] Elastic Kibana up to 8.19.20/9.4.5/9.5.2 Cribl Integration privileges management
A vulnerability labeled as problematic has been found in Elastic Kibana up to 8.19.20/9.4.5/9.5.2. Affected is an unknown function of the component Cribl Integration. The manipulation results in improper privilege management.
This vulnerability is reported as CVE-2026-78593. The attack can be launched remotely. No exploit exists.
GHSA
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a s
ghsa_unreviewed·2026-09-03
CVE-2026-78593 [MEDIUM] CWE-94 An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a s
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-03
Published