CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-78608

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges.

Score
6.5 medium
Published
2026-09-01
Links
NVD · cve.org · Report wrong data

Matched ports (6)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana8kibana88.19.21fixed by updateelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org
textproc/kibana95kibana959.5.4fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.21</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Missing Authorization (CWE-862) in Kibana can lead to information
	disclosure via Privilege Abuse (CAPEC-122). An authorization control
	was not applied to an internal Kibana APM integration function,
	allowing any authenticated Kibana user to read APM server credentials
	that should be restricted to users holding APM or Fleet administrative
	privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-78608</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-78608</url>
    </references>
    <dates>
      <discovery>2026-09-01</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>