« Volver al listado

CVE-2026-26939

Estado: AnalizadaMedia (6.5)—

Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Elastic — Kibana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-26939",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26939",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-19T17:50:20.698249Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@elastic.co",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@elastic.co",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Kibana",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.2.5"
            },
            {
              "status": "affected",
              "version": "9.3.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.3.0"
            },
            {
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.19.11"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-19T18:16:21.690",
  "references": [
    {
      "url": "https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@elastic.co"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@elastic.co",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges."
    },
    {
      "lang": "es",
      "value": "Autorización Faltante (CWE-862) en la Gestión de Reglas de Detección del lado del servidor de Kibana puede llevar a la Configuración de Acciones de Respuesta de Punto Final No Autorizada (aislamiento de host, terminación de proceso y suspensión de proceso) a través de CAPEC-1 (Acceso a Funcionalidad No Restringida Adecuadamente por ACLs). Esto requiere un atacante autenticado con privilegios de gestión de reglas."
    }
  ],
  "lastModified": "2026-06-17T10:26:25.367",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E939FB01-9CDD-4A24-B5E9-6F7A8C984917",
              "versionEndExcluding": "8.19.12",
              "versionStartIncluding": "8.0.0"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F14ACA8C-46A2-42EF-9F63-AEF657C6736A",
              "versionEndExcluding": "9.2.6",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:a:elastic:kibana:9.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E90DE12-A5EC-4C3C-A86E-BF5AA0778628"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@elastic.co"
}