{"id":"CVE-2026-115295","kind":"vulnerability","aliases":["CVE-2026-115295"],"related":[],"title":"Kibana: connector logs leak across spaces to users with read access","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.","summary":"An authenticated Kibana user with read access to connectors in one space can view connector execution logs from other spaces they should not reach. The exposed data includes connector names and IDs, execution status, timestamps, error messages, and aggregate execution statistics.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elastic-stack","infrastructure","kibana"],"not_affected_if":["no-connector-read-access","single-space"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:38+00:00","updated_at":"2026-11-03T17:24:38+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T17:24:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kibana: connector logs leak across spaces to users with read access","impact":"low","summary":"An authenticated Kibana user with read access to connectors in one space can view connector execution logs from other spaces they should not reach. The exposed data includes connector names and IDs, execution status, timestamps, error messages, and aggregate execution statistics.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kibana","elastic-stack"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Cross-space connector names, error messages and execution logs readable by low-privilege users","analyst_note":"Find affected and fixed Kibana versions and the vendor advisory for CVE-2026-115295 at the NVD entry.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-space","no-connector-read-access"],"who_is_affected":"Affects Kibana deployments that use multiple spaces and grant users connector read access. Single-space deployments or instances where connector read access is limited to trusted users are less exposed. The sources do not name the affected or fixed Kibana versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":4187,"output_tokens":458,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':89C '-115295':14A,17A '-2026':13A,16A '-639':72C 'access':11A,29B,81C,95C,117C 'acl':87C 'across':5A 'aggreg':61B,132C 'authent':24B,91C 'author':64C,115C 'bypass':65C 'capec':88C 'connector':2A,31B,37B,51B,97C,104C,122C 'constrain':85C 'control':69C 'cve':12A,15A 'cwe':71C 'data':49B 'disclos':119C 'disclosur':79C 'elast':19B 'elastic-stack':18B 'error':58B,129C 'execut':38B,55B,62B,105C,126C,133C 'expos':48B 'function':82C 'id':54B 'identifi':125C 'includ':50B,121C 'inform':78C,107C,120C 'infrastructur':21B 'key':70C 'kibana':1A,22B,25B,74C,100C 'lead':76C 'leak':4A 'log':3A,39B,106C 'messag':59B,130C 'name':52B,123C 'one':33B,99C 'proper':84C 'reach':46B 'read':10A,28B,94C 'retriev':103C 'space':6A,34B,42B,101C,110C 'stack':20B 'statist':63B,134C 'status':56B,127C 'timestamp':57B,128C 'user':8A,26B,68C,92C 'user-control':67C 'via':80C 'view':36B","nicknames":[],"mitigations":[],"who_affected":"Affects Kibana deployments that use multiple spaces and grant users connector read access. Single-space deployments or instances where connector read access is limited to trusted users are less exposed. The sources do not name the affected or fixed Kibana versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elasticstack","infrastructure","kibana","medium"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115295","severity":null,"published_at":"2026-11-03T17:17:55+00:00","modified_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}