CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-78597

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated cluster and Kibana privileges that the documented Entity Store setup flow requires.

Score
4.3 medium
Published
2026-09-01
Links
NVD · cve.org

Matched ports (5)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.21</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Missing Authorization (CWE-862) in the Kibana Entity Store feature can
	lead to unauthorized credential creation via Accessing Functionality
	Not Properly Constrained by ACLs (CAPEC-1). An authenticated user
	holding only low-privilege Security feature access could invoke an
	administrative operation that creates and persists Elasticsearch API
	keys under the caller's identity, bypassing the elevated cluster and
	Kibana privileges that the documented Entity Store setup flow
	requires.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-78597</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-78597</url>
    </references>
    <dates>
      <discovery>2026-09-01</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>