Description

Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T15:17:39.943Z",
  "pubdate": "2026-09-02T15:17:39.943Z",
  "executiveSummary": "This vulnerability involves an Observable Response Discrepancy (CWE-204) within the Kibana Osquery feature, which facilitates unauthorized information disclosure via Query System for Information (CAPEC-54).\nThe flaw allows an authenticated user with existing Osquery live-query privileges to perform enumeration of scheduled query identifiers across Kibana spaces.\nBy observing subtle differences in system responses—such as variations in error messages or latency when querying specific identifiers—an attacker can confirm the existence of queries in environments for which they lack explicit authorization.\nThis issue represents a significant security risk, as it permits lateral discovery of potentially sensitive system monitoring configurations and internal query structures across isolated Kibana spaces.\nThe exploit requires the attacker to be an authenticated user with specific Osquery permissions; however, it does not require administrative oversight of the target space, effectively bypassing logical access boundaries through side-channel inference.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of requests during the Osquery interaction flow, specifically regarding how the system validates access to scheduled query identifiers.\nThe vulnerability is classified as an Observable Response Discrepancy (CWE-204), where the system provides distinct, observable feedback depending on whether a requested resource—in this case, a scheduled query ID—exists, regardless of the user's authorization status for that resource.\nAttack flow typically begins with an attacker authenticated to a Kibana instance possessing the 'Osquery live-query' privilege. The attacker constructs a series of requests targeting specific, potentially sensitive scheduled query identifiers across different spaces.\nThe application processes these requests and, instead of returning a generic 'not found' or 'access denied' response for unauthorized attempts, returns a discrepancy in the response structure or processing time based on whether the query ID exists within the back-end registry.\nBy systematically iterating through possible query identifiers or probing for known patterns, an attacker can leverage this timing or response-based oracle to enumerate the configuration of other spaces. This constitutes a Query System for Information (CAPEC-54) attack, effectively turning the Osquery feature into an information disclosure vector.\nThe vulnerable component is the Osquery subsystem within Kibana, which fails to normalize the error handling and result sets returned to the client when evaluating queries across multi-tenant or multi-space environments.\nBecause the system reveals the state of existence for these identifiers, the impact extends beyond mere enumeration; an attacker can map the security monitoring posture, identify internal naming conventions, and infer the presence of specific monitoring rules deployed by other users or administrative groups.\nThe exploitation does not require advanced network-level access or cross-site scripting (XSS), as the vulnerability is inherent to the application's API logic. Once the response discrepancy is identified, the attacker can automate the discovery process using standard HTTP request patterns."
}