CVE-2026-82302: 
Kibana vulnerability analysis and mitigation

CVE-2026-82302 is an Incorrect Authorization vulnerability (CWE-863) in Elastic Kibana that allows authenticated low-privilege users to bypass access controls and perform unauthorized configuration modifications. It affects Kibana versions 8.0.0 through 8.19.20, 9.0.0 through 9.4.5, and 9.5.0 through 9.5.2. The vulnerability was published on September 3, 2026, with a patch available as of the same date. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Elastic Advisory).

The root cause is Incorrect Authorization (CWE-863), where Kibana fails to correctly enforce access control checks when a low-privilege user attempts to access or modify restricted configuration resources. This maps to CAPEC-180 (Exploiting Incorrectly Configured Access Control Security Levels), meaning the application's authorization logic does not properly validate whether the requesting user holds sufficient privileges for the requested operation. Exploitation requires only a valid low-privilege account and network access to the Kibana instance — no user interaction or elevated privileges are needed. No public proof-of-concept code has been identified at this time (GitHub Advisory, Elastic Advisory).

Successful exploitation allows any authenticated Kibana user with low privileges to read and modify system configurations that should be restricted to administrators, resulting in high confidentiality and high integrity impact with no availability impact. This could enable an attacker to alter security-relevant settings, expose sensitive configuration data, or manipulate Kibana's behavior in ways that facilitate further compromise of the Elastic Stack environment. The NVD SSVC assessment classifies the technical impact as "total" for affected components (GitHub Advisory, Elastic Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.20% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (detection ID 520277) (GitHub Advisory, Elastic Advisory).

Elastic has released patched versions addressing this vulnerability: 8.19.22, 9.4.7, and 9.5.3. Users running affected versions (8.0.0–8.19.20, 9.0.0–9.4.5, or 9.5.0–9.5.2) should upgrade to the respective fixed release immediately. As an interim measure, administrators should audit Kibana role-based access control (RBAC) configurations to ensure configuration modification privileges are restricted to authorized administrator roles only, and review recent configuration changes made by low-privilege accounts (Elastic Advisory, GitHub Advisory).

The vulnerability was disclosed by Elastic via their official security advisory forum (ESA-2026-178) and catalogued in the GitHub Advisory Database (GHSA-23j5-gc8f-m7mc). Automated threat intelligence aggregators including radar.offseq.com, cvefeed.io, and vuldb.com indexed the vulnerability shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking activity (Elastic Advisory, GitHub Advisory).