{"id":"CVE-2026-115293","kind":"vulnerability","aliases":["CVE-2026-115293"],"related":[],"title":"Kibana: Observability onboarding leaks Elasticsearch service credentials to authenticated users","description":"Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.","summary":"Kibana's Observability onboarding can expose the credentials Kibana uses to connect to Elasticsearch when those credentials are embedded in the Elasticsearch host URLs. An authenticated user with Observability onboarding privileges can retrieve them and access Elasticsearch directly with the Kibana service account's privileges.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elasticsearch","kibana","package","self-hosted"],"not_affected_if":["credentials-not-in-host-urls","no-observability-onboarding-users"],"how_to_check":"- Check whether the Elasticsearch host URLs in the Kibana configuration (`elasticsearch.hosts`) contain embedded username and password credentials.\n- Check the installed Kibana version with `kibana --version` against the affected ranges, which the sources do not state: unknown.","fix":null,"status":"open","published_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:17+00:00","updated_at":"2026-11-03T17:24:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T17:24:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kibana: Observability onboarding leaks Elasticsearch service credentials to authenticated users","impact":"high","summary":"Kibana's Observability onboarding can expose the credentials Kibana uses to connect to Elasticsearch when those credentials are embedded in the Elasticsearch host URLs. An authenticated user with Observability onboarding privileges can retrieve them and access Elasticsearch directly with the Kibana service account's privileges.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kibana","elasticsearch","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads Kibana's Elasticsearch service account credentials and accesses Elasticsearch directly","analyst_note":"Check the Elastic advisory for affected and fixed Kibana versions and confirm the exact configuration condition; the sources give neither.","how_to_check":"- Check whether the Elasticsearch host URLs in the Kibana configuration (`elasticsearch.hosts`) contain embedded username and password credentials.\n- Check the installed Kibana version with `kibana --version` against the affected ranges, which the sources do not state: unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["credentials-not-in-host-urls","no-observability-onboarding-users"],"who_is_affected":"Teams running self-hosted Kibana with Observability onboarding enabled, where Elasticsearch credentials are written into the host URLs in the Kibana configuration. Deployments that pass credentials separately from the host URLs are not described as affected. Users who lack Observability onboarding privileges are outside the described attack path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4200,"output_tokens":639,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115293':13A,16A '-201':76C '-2026':12A,15A 'access':58B,126C 'account':65B,136C 'authent':9A,48B,110C 'configur':108C 'connect':34B,92C 'credenti':7A,30B,39B,87C,97C 'cve':11A,14A 'cwe':75C 'data':74C,118C 'direct':60B,128C 'disclosur':84C 'elasticsearch':5A,17B,36B,44B,59B,94C,102C,127C 'embed':41B,99C 'expos':28B 'grant':142C 'host':22B,45B,103C 'inform':71C 'insert':68C 'kibana':1A,18B,23B,31B,63B,78C,89C,107C,134C 'lead':82C 'leak':4A 'observ':2A,25B,51B,79C,117C 'obtain':120C 'onboard':3A,26B,52B,80C,116C 'outsid':139C 'packag':19B 'privileg':53B,67B,114C,131C,141C 'retriev':55B 'self':21B 'self-host':20B 'sensit':70C 'sent':73C 'servic':6A,64B,135C 'url':46B,104C 'use':32B,90C 'user':10A,49B,111C,123C,145C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Kibana with Observability onboarding enabled, where Elasticsearch credentials are written into the host URLs in the Kibana configuration. Deployments that pass credentials separately from the host URLs are not described as affected. Users who lack Observability onboarding privileges are outside the described attack path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elasticsearch","kibana","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115293","severity":null,"published_at":"2026-11-03T17:17:55+00:00","modified_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}