Description

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T20:17:27.033Z",
  "pubdate": "2026-08-13T20:17:27.033Z",
  "executiveSummary": "A Missing Authorization vulnerability identified as CWE-862 exists in Kibana, leading to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs).\nThe impact of this vulnerability allows unauthorized users to trigger sensitive agent capabilities, potentially resulting in the disclosure of sensitive information from affected hosts or unauthorized state changes.\nThe affected product is Kibana, impacting users interacting with Elastic Security detection rules and managed hosts.\nThe risk implications are significant as unauthorized execution of response actions bypasses expected privilege boundaries, compromising host integrity and confidentiality.\nAn attacker must possess the ability to author and evaluate Elastic Security detection rules within Kibana to exploit the flaw.\nExploitation requirements include authenticated access to Kibana with permissions to create detection rules, while lacking the explicit Osquery live query privileges or Elastic Defend response action privileges normally required to govern those capabilities.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement within Kibana, specifically regarding the linkage between Elastic Security detection rule authoring/evaluation and the invocation of Osquery and Elastic Defend response actions on enrolled agents.\nThe vulnerable component involves the authorization checks governing response actions tied to detection rules within the Kibana security framework.\nExploitation occurs because the application fails to properly validate whether the user authoring and evaluating detection rules holds the requisite Osquery live query privileges or Elastic Defend response action privileges before dispatching commands to managed hosts.\nThe attack flow begins when a malicious or unauthorized Kibana user creates or configures an Elastic Security detection rule designed to trigger specific response actions upon evaluation.\nDuring rule evaluation, the backend executes the configured Osquery or Elastic Defend response actions against enrolled agents without performing the necessary privilege checks against the initiating user's access control list.\nAuthentication requirements dictate that the attacker must have valid user access to Kibana with permissions to author detection rules.\nPrivilege requirements are bypassed during the exploitation phase, allowing users without administrative or specific operational privileges for Osquery and Elastic Defend to effectively command managed hosts.\nNetwork exposure relies on access to the Kibana interface where detection rules are managed.\nPayload behavior involves the unauthorized dispatch of Osquery live queries or Elastic Defend response actions to target hosts.\nThe post-exploitation impact includes the potential exposure of sensitive system information retrieved via live queries or unauthorized state modifications executed through agent response actions."
}