Is CVE-2026-78593 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78593 being exploited in the wild.

How severe is CVE-2026-78593?

Medium severity, with a CVSS score of 4.3, published 3 September 2026.

Which products and versions are affected?

Elastic Kibana 8.0.0 to 8.19.20, 9.0.0 to 9.4.5, 9.5.0 to 9.5.2.

Is there a fix for CVE-2026-78593?

A patch was published on 2026-09-03: Fixed in Kibana 8.19.21, 9.4.6, 9.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78593 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-78593?

Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78593: Elastic Kibana code injection in Cribl integration

CVE-2026-78593 · Severity: medium · CVSS 4.3 · Published 2026-09-03

Kibana, a widely-used analytics and visualization platform, contains a vulnerability in its Cribl data integration that allows authenticated administrators with Fleet management privileges to inject malicious code. An attacker with these privileges can manipulate Elasticsearch ingest pipeline configurations beyond their authorized permissions, potentially modifying how data flows through the system and affecting data integrity across the deployment.

Technologies: Elastic Kibana. Vendors: Elastic.

Quick answers

Is CVE-2026-78593 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78593 being exploited in the wild.
How severe is CVE-2026-78593?: Medium severity, with a CVSS score of 4.3, published 3 September 2026.
Which products and versions are affected?: Elastic Kibana 8.0.0 to 8.19.20, 9.0.0 to 9.4.5, 9.5.0 to 9.5.2.
Is there a fix for CVE-2026-78593?: A patch was published on 2026-09-03: Fixed in Kibana 8.19.21, 9.4.6, 9.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78593 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-78593?: Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a code injection flaw (CWE-94) in Kibana's Cribl integration caused by insufficient validation of a configuration field. An authenticated user holding Fleet management privileges (fleet:all) can inject attacker-controlled expressions into a server-side script template, leading to arbitrary modification of Elasticsearch ingest pipelines with escalated privileges. The attack requires valid Kibana authentication and the Fleet management role; no user interaction or special configuration beyond having the Cribl integration installed is needed. An attacker can write ingest pipelines beyond their authorized Elasticsearch permissions, potentially altering data processing rules. The vulnerability is fixed in Kibana versions 8.19.21, 9.4.6, and 9.5.3.

Affected products

Elastic Kibana 8.0.0 to 8.19.20, 9.0.0 to 9.4.5, 9.5.0 to 9.5.2

Timeline

2026-09-03: disclosed: CVE-2026-78593 public disclosure
2026-09-03: patched: Fixed in Kibana 8.19.21, 9.4.6, 9.5.3

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.