VulnSocial

CVE-2026-115295

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-11-03: 111-03
Referenced assets1 URL
Full discourse1 post
  • Rodrigo ☕︎ 🤷🏻‍♂️ 👇🏻@rodgui

    Kibana corrigiu acesso indevido a logs de conectores entre spaces (CVE-2026-115295). Quem tem leitura de conectores em um space podia ver logs de outros. Atualize para 8.19.24, 9.4.9 ou 9.5.6. Isolamento precisa valer também para a telemetria. https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360

    0000036
    340 followersView on X

Explore more

Back to dashboard