CVE-2026-78597 — Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAP…
Published: 2026-09-01 · CVSS: 4.3 · CVSS 3.1
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7