CVE-2026-26939 | THREATINT

Description

Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.

PUBLISHED Reserved 2026-02-16 | Published 2026-03-19 | Updated 2026-03-19 | Assigner elastic

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Problem types

CWE-862 Missing Authorization

Product status

Default status

unaffected

9.0.0 (semver)

affected

9.3.0 (semver)

affected

8.0.0 (semver)

affected

References

discuss.elastic.co/...3-1-security-update-esa-2026-19/385530

cve.org (CVE-2026-26939)

nvd.nist.gov (CVE-2026-26939)

Download JSON