CVE-2026-78582

Executive Summary

CVE-2026-78582 is a Missing Authorization vulnerability (CWE-862) in Kibana's Synthetics functionality, with a CVSS v3.1 base score of 6.5. An authenticated user holding Synthetics privileges scoped to a single Kibana space can permanently delete Synthetics monitors that have been shared into other spaces to which the user has no access. When a deleted monitor is associated with a private location, the operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would normally enforce. The vulnerability is currently unpatched, has no public proof-of-concept, is not listed in CISA KEV, and has not yet been scored by FIRST.org EPSS.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862), mapped to the CAPEC-180 pattern "Exploiting Incorrectly Configured Access Control Security Levels." At its core, the flaw is a broken tenant/space-scoping control: Kibana's role-based access control (RBAC) models Synthetics privileges on a per-space basis, but the delete operation for a Synthetics monitor fails to enforce that scoping against objects shared across space boundaries.

The described attack surface has two distinct components:

1. Cross-space Synthetics monitor deletion. A Synthetics monitor created in one Kibana space can be "shared" into additional spaces. The authorization check on the delete operation appears to validate only that the requesting principal holds Synthetics delete privileges somewhere (here, within a single space), rather than validating that the principal holds privileges over the target monitor in every space it is shared into — or over the object itself. The result is horizontal authorization bypass: a user who legitimately controls Synthetics in Space A can permanently delete a monitor whose lifecycle is owned by Space B, because the object-level ownership scope is not re-checked at deletion time.

2. Fleet / Elastic Agent integration collateral. When a Synthetics monitor is associated with a "private location," the monitor is backed by an Elastic Agent integration configuration managed by Fleet. Deleting the monitor through the Synthetics path evidently cascades to the underlying Agent integration configuration without routing the change through Fleet's own authorization layer. Fleet would normally apply its own permission checks before permitting modification of Agent integration state; the Synthetics deletion path bypasses those checks entirely, producing unauthorized destructive changes in a second subsystem.

Both behaviors are integrity-impacting (CVSS I:H). There is no confidentiality impact (C:N) because no data is read beyond what the authenticated user can already enumerate, and no availability impact (C:N/A:N) is scored by NVD — the deletion is modeled as data integrity loss rather than a service outage, though in practice destruction of monitor and Agent configuration does have operational availability consequences. The vector AV:N/AC:L/PR:L/UI:N denotes a network-reachable flaw requiring low attack complexity, low privileges (an authenticated account with Synthetics rights in one space), and no user interaction.

The vulnerability class — authorization bypass on a destructive, state-mutating operation affecting cross-boundary shared objects — is significant because the operation is irreversible. There is no "read" or "probe" phase that a defender can safely observe; successful exploitation results in permanent data loss.

No public proof-of-concept, Nuclei template, or exploit code exists. No affected version range was supplied in the source intelligence, and patch confidence is 0/4 with no vendor fix, workaround, or tracked patch source. All mechanism descriptions above are derived strictly from the supplied NVD description and CAPEC/CWE mappings; no function names, endpoints, or parameters are asserted because none were provided.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authorization / broken object-level access control) and the specific behaviors documented in the NVD description.

1) Reconnaissance / target identification. The attacker requires an authenticated Kibana account. They identify (or are provisioned) a role with Synthetics privileges scoped to a single Kibana space — for example, a developer or observability team member belonging to one business unit. Using ordinary Kibana navigation available to that account, the attacker enumerates Synthetics monitors visible to them. Where monitors are shared into their space, the shared objects are disclosed to this account, revealing the existence of monitors owned by other spaces, including monitors that reference private locations.

2) Triggering the authorization flaw. The attacker selects a Synthetics monitor that is shared into their space but is not owned by their space, and issues the delete (monitor removal) operation against it. Because the authorization check on this path validates only the attacker's Synthetics privilege in their own space and does not re-validate object ownership or the target space's access-control level, the operation is permitted. This is the CAPEC-180 pattern: the access control level is configured/checked incorrectly, so a lower-privileged principal performs a higher-privileged action.

3) Execution at the vulnerability-class level. The payload is a legitimate, authenticated destructive API action — no injection, no malformed input, no memory corruption. The attack is a semantically valid request that is under-authorized. This makes it indistinguishable at the request-syntax level from a legitimate administrative deletion; only the principal's scope versus the target object's ownership scope reveals the abuse.

4) Post-exploitation impact. The monitor is permanently deleted — recovery requires the owning team to recreate it, and any historical/associated configuration may be lost. Where the deleted monitor was associated with a private location, the destructive cascade additionally removes the underlying Elastic Agent integration configuration on the Fleet side, without the checks Fleet would ordinarily apply. The attacker thereby (a) crosses a space/tenant boundary they are not authorized to touch, (b) corrupts configuration in a second subsystem (Fleet), and (c) can repeat the action across any enumerable shared monitor, enabling systematic destruction of another team's or tenant's observability coverage. Because the operation is destructive and irreversible, this constitutes a targeted integrity attack rather than opportunistic misuse.

Impact Assessment

• CVSS v3.1 base 6.5 (Medium). Sub-scores: AV:N (network reachable), AC:L (no special conditions or race), PR:L (authenticated low-privilege account required), UI:N (no victim interaction), S:U (impact confined to Kibana/Fleet scope, no scope change scored), C:N (no confidentiality loss modeled), I:H (high integrity impact — permanent, unauthorized deletion of monitors and Fleet Agent integration configuration), A:N (availability not scored, despite operational service loss in practice).
• Business impact. Destruction of Synthetics monitors removes uptime/availability monitoring coverage for affected services — a monitoring blind spot that adversaries or negligent insiders can leverage. Deletion of the underlying Elastic Agent integration configuration degrades the endpoint/observability data pipeline, potentially creating detection gaps across the Fleet-managed estate.
• Blast radius. Bounded by the number of Synthetics monitors shared across space boundaries from the attacker's accessible space, and by how many of those are tied to private locations (the subset that also destroys Fleet integration state). In multi-tenant or multi-business-unit Kibana deployments with liberal cross-space monitor sharing, this radius can be large: a single mis-scoped operator account can reach every shared monitor visible to it.
• Threat model. Most plausible actor is a malicious or careless insider, or an external attacker who has obtained any low-privileged Kibana account with Synthetics access — for example via credential theft or a separate foothold. No exploit-in-the-wild or threat-actor activity has been reported for this CVE.

Detection Guidance

The following rules are purpose-built for this CVE's observable behaviors: anomalous cross-space Synthetics monitor deletion and cascading Fleet Agent integration removal by a principal not scoped to the owning space. Because the underlying action is a legitimate API call, detections must key on authorization context (actor space vs. object owning space) rather than request syntax. Tune space names, indices, and field names to the environment before deployment.

Sigma Rule

title: Kibana Synthetics Monitor Deletion Outside Owning Space (CVE-2026-78582)
id: 8c2f4e1a-9b7d-4f3e-a1c2-6d5e0f9b3a71
status: experimental
description: Detects deletion of a Kibana Synthetics monitor by a user whose Synthetics privileges are scoped to a space that does not own the monitor, consistent with CVE-2026-78582 missing authorization and possible cascading Fleet Agent integration removal.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78582
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.862
  - capec.180
logsource:
  product: elastic
  service: kibana
detection:
  selection_event:
    event.action:
      - 'synthetics-monitor-delete'
      - 'synthetics.delete'
      - 'monitor_delete'
  selection_cross_space:
    kibana.saved_object.space_id|exists: true
    user.effective_space_id|exists: true
  filter_same_space:
    kibana.saved_object.space_id: '%user.effective_space_id%'
  condition: selection_event and selection_cross_space and not filter_same_space
fields:
  - user.name
  - user.effective_space_id
  - kibana.saved_object.space_id
  - kibana.saved_object.id
  - source.ip
falsepositives:
  - Legitimate global administrators intentionally managing cross-space monitors
  - Automated lifecycle tooling running with superuser privileges
level: high

YARA Rule

rule CVE_2026_78582_Kibana_Synthetics_CrossSpace_Delete
{
    meta:
        description = "Detects Kibana/Fleet log entries indicating unauthorized cross-space deletion of a Synthetics monitor and possible cascading Elastic Agent integration removal (CVE-2026-78582)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78582"
        date = "2026-01-01"
        cwe = "CWE-862"
        severity = "high"

    strings:
        $s1 = "synthetics-monitor-delete" ascii wide nocase
        $s2 = "synthetics" ascii wide nocase
        $s3 = "monitor" ascii wide nocase
        $f1 = "fleet" ascii wide nocase
        $f2 = "agent" ascii wide nocase
        $f3 = "integration" ascii wide nocase
        $sc = "space_id" ascii wide nocase
        $del = "delete" ascii wide nocase

    condition:
        ($s1 or ($s2 and $s3 and $del)) and ($f1 and $f2 and $f3) and $sc
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78582 Kibana Synthetics monitor deletion via API"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"/api/synthetics"; nocase; http.uri; content:"/monitors"; nocase; classtype:attempted-admin; reference:cve,2026-78582; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78582; metadata:affected_product Kibana, attack_target Web_Server, created_at 2026_01_01, cve CVE_2026_78582, signature_severity Major; sid:202678582; rev:1;)

Note: URI fragments above reflect the general Kibana Synthetics API surface. Confirm the exact production path in the target deployment before enabling; because the request is a valid authenticated call, correlate this network signature with the authorization-context detections (Sigma/EQL/SPL/Wazuh) to avoid false positives from legitimate deletions.

Elastic Detection

sequence by user.name with maxspan=30s
  [any where event.action in ("synthetics-monitor-delete","synthetics.delete")
     and kibana.saved_object.space_id != null
     and user.effective_space_id != null
     and kibana.saved_object.space_id != user.effective_space_id]
  [any where event.category == "configuration"
     and event.action in ("fleet-agent-integration-delete","agent-policy-change")
     and user.effective_space_id != null]

Splunk SPL Query

index=elastic OR index=kibana sourcetype IN ("kibana:audit","elastic:audit")
(event.action="synthetics-monitor-delete" OR event.action="synthetics.delete" OR match(message,"(?i)delet.*synthetics.*monitor"))
| eval owner_space=kibana.saved_object.space_id, actor_space=user.effective_space_id
| where owner_space!=actor_space AND isnotnull(owner_space) AND isnotnull(actor_space)
| append
    [ search index=elastic sourcetype="fleet:audit" (event.action="fleet-agent-integration-delete" OR match(message,"(?i)(delete|remove).*integration"))
      | eval owner_space=integration.space_id ]
| stats count values(event.action) as actions values(owner_space) as target_spaces values(actor_space) as actor_spaces by user.name, user.effective_space_id, source.ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="elastic,kibana,">
  <rule id="100782" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">synthetics-monitor-delete</field>
    <description>CVE-2026-78582: Kibana Synthetics monitor deletion observed - verify actor space vs. monitor owning space.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authorization_bypass,integrity,</group>
  </rule>

  <rule id="100783" level="14">
    <if_sid>100782</if_sid>
    <field name="kibana\.saved_object\.space_id" negate="no">\.+</field>
    <description>CVE-2026-78582: Cross-space Synthetics monitor deletion by user $(user.name) - potential missing authorization and Fleet integration cascade.</description>
    <group>authorization_bypass,integrity,high_priority,</group>
  </rule>

  <rule id="100784" level="15">
    <decoded_as>json</decoded_as>
    <field name="event.action">fleet-agent-integration-delete</field>
    <description>CVE-2026-78582: Elastic Agent integration configuration deleted - possible cascading unauthorized Fleet modification.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authorization_bypass,integrity,high_priority,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (compensating controls while unpatched):

• Audit all Kibana roles holding Synthetics privileges. Remove or reduce Synthetics delete/all privileges for accounts and roles that do not own the monitors in the spaces they serve; scope roles to their own space only.
• Minimize cross-space sharing of Synthetics monitors. Any monitor shared into a space grants the operation's visibility to that space's principals; limit sharing to the smallest necessary set of spaces.
• Where practical, restrict Synthetics monitor delete/management capability to a small set of dedicated, trusted global-admin roles, and separate monitor viewing from monitor deletion via custom roles.
• Constrain Synthetics monitors tied to private locations so they are owned by a space with a narrow, well-controlled membership, since deletion of these additionally destroys Fleet Agent integration configuration.
• Monitor audit logs (see Detection Guidance) for cross-space Synthetics deletions and for Fleet Agent integration deletions that follow them.

2) Patch/upgrade steps:

• No vendor fix, affected version range, or patch reference is available in the tracked intelligence for this CVE. Track the Elastic Security Advisories (https://www.elastic.co/community/security) and the NVD entry for the vendor's fixed Kibana version.
• When a vendor advisory or fixed version is published, upgrade Kibana (and ensure Fleet/Elastic Agent components are updated consistently) following Elastic's upgrade guidance, and re-verify RBAC space-scoping on the Synthetics delete path afterward.
• Until a fix exists, treat any affected Kibana deployment as unpatched and prioritize the compensating controls above.

3) Long-term hardening:

• Adopt object-level authorization review for all cross-boundary destructive operations (delete/modify of shared objects), ensuring every state-mutating path re-checks ownership and target-space access levels rather than validating privilege in the caller's own space alone.
• Enforce least privilege and strict space separation in Kibana; avoid broad sharing of lifecycle-managed objects across tenant boundaries.
• Ensure secondary subsystems (Fleet/Elastic Agent) maintain independent authorization enforcement even when invoked from other Kibana features, and validate that no feature path bypasses those checks.
• Retain comprehensive audit logging for Synthetics and Fleet operations, with alerting on cross-space delete patterns, and rehearse restoration of deleted monitors/integrations to reduce recovery time from destructive integrity events.

References

• NVD — CVE-2026-78582: https://nvd.nist.gov/vuln/detail/CVE-2026-78582
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels — https://capec.mitre.org/data/definitions/180.html
• Elastic Security Advisories (track for vendor fix) — https://www.elastic.co/community/security
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

CISA KEV status: NOT listed. EPSS: not yet scored by FIRST.org. Threat-actor campaigns / exploit-in-the-wild: none reported. Public PoC: none.