# CVE-2026-115293: Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure

> CVE-2026-115293: Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-115293
Last updated: 2026-11-03T20:32:50Z

- Published: 2026-11-03 16:44 UTC · Updated: 2026-11-03 20:32 UTC · Assigner: elastic
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.37%, 31th percentile (scored 2026-11-10)
- CISA KEV: no
- CWE: CWE-201

## Description

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-115293)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-115293)
- [https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358](https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-115293 · Markdown: https://rewindex.com/cve/CVE-2026-115293.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-115293 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T04:21:36.007Z