---
id: "CVE-2026-115293"
kind: "vulnerability"
aliases: ["CVE-2026-115293"]
title: "Kibana: Observability onboarding leaks Elasticsearch service credentials to authenticated users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elasticsearch", "kibana", "package", "self-hosted"]
not_affected_if: ["credentials-not-in-host-urls", "no-observability-onboarding-users"]
published_at: "2026-11-03T17:17:55+00:00"
first_seen_at: "2026-11-03T17:21:54+00:00"
updated_at: "2026-11-03T17:24:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115293", "first_seen_at": "2026-11-03T17:21:54+00:00"}]
---

# Kibana: Observability onboarding leaks Elasticsearch service credentials to authenticated users

Kibana's Observability onboarding can expose the credentials Kibana uses to connect to Elasticsearch when those credentials are embedded in the Elasticsearch host URLs. An authenticated user with Observability onboarding privileges can retrieve them and access Elasticsearch directly with the Kibana service account's privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Elasticsearch host URLs in the Kibana configuration (`elasticsearch.hosts`) contain embedded username and password credentials.
- Check the installed Kibana version with `kibana --version` against the affected ranges, which the sources do not state: unknown.

## Timeline

- 2026-11-03T17:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115293

## From the sources

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_