Executive brief
Kibana, an analytics and visualization platform for Elasticsearch, contains a missing authorization flaw in its Entity Store feature that allows low-privilege users to create API keys with escalated permissions. A low-privilege authenticated user can invoke administrative operations to persist Elasticsearch API keys, effectively gaining unauthorized credential creation capabilities that should only be available to administrators.
Technical details
This vulnerability is a missing authorization (CWE-862) flaw in the Kibana Entity Store feature. An authenticated user with only low-privilege Security feature access can invoke administrative API operations that create and persist Elasticsearch API keys under their identity, bypassing the required elevated cluster and Kibana privileges documented in the Entity Store setup flow. The attack requires network access and valid Kibana authentication; no user interaction is needed. An attacker can create API keys under their own identity, leading to credential escalation and potential lateral movement. The vulnerability has been fixed in Kibana 8.19.21 and 9.4.6; users on Kibana 9.5.0 and later are unaffected as the vulnerable Entity Store v1 administrative surface was removed.
Affected products
- Elastic Kibana 8.0.0 through 8.19.20, 9.0.3 through 9.4.5
Timeline
- 2026-09-01: disclosed: Security advisory ESA-2026-155 published
- 2026-09-01: patched: Fixed in Kibana 8.19.21 and 9.4.6