Executive brief
Kibana, a data visualization and analytics platform used to search and analyze data in Elasticsearch, contains a missing authorization control in its Entity Store configuration feature. An authenticated administrator can exploit this to indirectly access Elasticsearch data they should not have permission to view, exposing sensitive information through the entity store interface. This affects deployments running Kibana 9.4.0–9.4.4 that have the Entity Store v2 feature enabled.
Technical details
The vulnerability is a missing authorization check (CWE-862) in a Kibana Entity Store configuration operation. An authenticated user with elevated Kibana privileges can misconfigure the Entity Store to cause a background task to read from Elasticsearch indices the user lacks authorization to access. The derived entity data from those restricted indices is then exposed through entity store output, resulting in information disclosure. Attack requires network access to Kibana, valid elevated credentials, and Entity Store v2 to be enabled with a Platinum+ license. The vulnerability is fixed in Kibana 9.4.5; versions prior to 9.4.0 and all 8.x releases are unaffected.
Affected products
- Elastic Kibana 9.4.0 through 9.4.4
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in Kibana 9.4.5