Executive brief
Kibana is a popular data visualization and analysis tool used to search and explore data stored in Elasticsearch. An authenticated user with Osquery query privileges can exploit a response timing discrepancy to determine whether scheduled queries exist in other Kibana spaces they are not authorized to access, potentially revealing information about security monitoring activities or configurations in restricted areas.
Technical details
This vulnerability exploits an observable response discrepancy (CWE-204) in the Kibana Osquery feature that allows information disclosure via query system reconnaissance (CAPEC-54). An authenticated user holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space outside their authorization scope by analyzing response differences. The vulnerability affects Kibana versions 9.4.0 through 9.4.3; the 8.x release line is unaffected as the vulnerable code was introduced in 9.4.0. The issue is resolved in Kibana 9.4.4. The attack requires network access to Kibana and valid authentication with Osquery privileges, but no additional user interaction is needed.
Affected products
- Elastic Kibana 9.4.0 through 9.4.3
Timeline
- 2026-09-02: disclosed: CVE-2026-78584 published
- 2026-09-02: patched: Fixed in Kibana 9.4.4