Description

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-13T20:17:27.777Z",
  "pubdate": "2026-08-13T20:17:27.777Z",
  "executiveSummary": "An information disclosure vulnerability affects the Elastic Security capability that suggests existing field values during endpoint policy artifact authorship within Elastic Defend.\nThe vulnerability arises because queries targeting Elastic Defend event data are executed using Kibana's internal Elasticsearch service account rather than the context of the requesting user.\nConsequently, authorization checks validate only Kibana feature privileges while omitting the caller's underlying Elasticsearch index-level permissions.\nAn authenticated user who possesses standard Elastic Security feature privileges but lacks explicit read access to the underlying Elastic Defend event indices can exploit this flaw to successfully retrieve sensitive field values.\nThe impacted data includes process command line arguments, which frequently store high-value operational secrets such as plaintext authentication tokens, credentials, database connection strings, and other sensitive environmental details gathered from protected endpoints.\nSuccessful exploitation requires valid authentication to Kibana alongside requisite Elastic Security feature privileges, allowing low-privileged users to bypass index-level security boundaries and harvest sensitive telemetry data.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the query execution path for endpoint policy artifact authoring in Elastic Security.\nWhen a user requests existing field suggestions for endpoint policies, the application queries underlying Elastic Defend event data.\nInstead of delegating the query to Elasticsearch using the authenticated user's security token and validating both feature and index privileges, the system executes the request utilizing Kibana's internal Elasticsearch account.\nAs a result of this architectural flaw, the authorization logic validates only whether the caller possesses appropriate Kibana feature privileges, completely failing to enforce the caller's Elasticsearch index-level read permissions.\nThe attack flow proceeds as follows: First, an authenticated actor with valid Elastic Security feature privileges navigates to the endpoint policy authorship interface in Kibana. Second, the user interacts with or triggers the field value suggestion feature. Third, Kibana formulates and executes a query against the Elastic Defend event indices using its internal system privileges, bypassing index access controls. Fourth, Elasticsearch returns the requested field values back to Kibana, which then presents them to the unauthorized user within the UI.\nThis behavior permits a low-privileged user or an insider with restricted data access to systematically harvest sensitive data stored within event indices.\nThe payload behavior involves programmatic or manual UI-driven querying of fields known to contain sensitive operational data, most notably process command line arguments (process.command_line) captured by Elastic Defend agents.\nPost-exploitation impact includes the exposure of critical credentials, API tokens, connection strings, and internal infrastructure configuration details, significantly increasing the risk of lateral movement, privilege escalation, and full environment compromise."
}