Live › vulnerability › CVE-2026-115293
Kibana's Observability onboarding can expose the credentials Kibana uses to connect to Elasticsearch when those credentials are embedded in the Elasticsearch host URLs. An authenticated user with Observability onboarding privileges can retrieve them and access Elasticsearch directly with the Kibana service account's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams running self-hosted Kibana with Observability onboarding enabled, where Elasticsearch credentials are written into the host URLs in the Kibana configuration. Deployments that pass credentials separately from the host URLs are not described as affected. Users who lack Observability onboarding privileges are outside the described attack path.
No product ranges from the sources yet.
elasticsearch.hosts) contain embedded username and password credentials.kibana --version against the affected ranges, which the sources do not state: unknown.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.
This page as .md · .json · in your agent: get_signal("CVE-2026-115293")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.