# CVE-2026-115293: Elastic Kibana credential disclosure in Observability onboarding

Source: https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-115293 · Severity: medium · CVSS 6.5 · Published 2026-11-03

Kibana, a data visualization and exploration platform used for analytics, can leak Elasticsearch database credentials through its Observability onboarding feature. An authenticated user with Observability privileges can extract embedded credentials from the configuration and use them to access Elasticsearch directly with elevated permissions beyond their normal role. This allows privilege escalation and unauthorized database access.

Technologies: [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115293 being exploited in the wild.

**How severe is CVE-2026-115293?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** Elastic Kibana 8.10.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5.

**Is there a fix for CVE-2026-115293?** Yes: fixed in Kibana 8.19.24, 9.4.9, 9.5.6. Until then: Remove credentials from elasticsearch.hosts in kibana.yml and configure them separately using elasticsearch.serviceAccountToken, elasticsearch.username/password, or (in version 8.16.0+) set elasticsearch.publicBaseUrl to the Elasticsearch URL without credentials. After applying the fix or workaround, rotate the leaked Elasticsearch credentials.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-03"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115293 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115293?** Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Kibana 8.19.24, 9.4.9, 9.5.6

Remove credentials from elasticsearch.hosts in kibana.yml and configure them separately using elasticsearch.serviceAccountToken, elasticsearch.username/password, or (in version 8.16.0+) set elasticsearch.publicBaseUrl to the Elasticsearch URL without credentials. After applying the fix or workaround, rotate the leaked Elasticsearch credentials.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-11-03"}]

## Technical details

CWE-201 information disclosure via the Kibana Observability onboarding component. Authenticated users with onboarding privileges can extract Elasticsearch credentials that are embedded in the elasticsearch.hosts configuration URLs. The vulnerability occurs only when credentials are embedded in the host URL and (in versions 8.16.0+) no public Elasticsearch base URL is set. An attacker gains direct Elasticsearch access with the Kibana service account's full privileges, bypassing Kibana's role-based access controls.

## Affected products

- Elastic Kibana 8.10.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5

## References

- [https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358](https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358)

## Related threats

- [Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe)
- [Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana incorrect authorization in Fleet settings](https://junglewise.ai/threats/cve-2026-102412-incorrect-authorization-cwe-863-in-kibana-can-lead-to-sensitive)
- [Elastic Kibana missing authorization in Metrics Experience](https://junglewise.ai/threats/cve-2026-102410-missing-authorization-cwe-862-in-kibana-can-lead-to-information)