CVE-2026-78593: CWE-94 Improper Control of Generation of Code ('Code Injection') in Elastic Kibana

This vulnerability arises from insufficient validation of a configuration field in Kibana's Cribl integration. An authenticated user with Fleet management privileges can inject malicious expressions into a server-side script template, causing an Elasticsearch ingest pipeline to be written with permissions exceeding those authorized for the user. The issue is classified as CWE-94 (Improper Control of Generation of Code, aka Code Injection). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with authenticated Kibana Fleet management privileges can inject code that causes an Elasticsearch ingest pipeline to be created or modified beyond their authorized permissions. This could lead to unauthorized changes in the Elasticsearch environment, potentially affecting data processing pipelines. There is no direct confidentiality or availability impact reported. The impact is limited to integrity due to unauthorized pipeline modification.

No official patch or remediation level is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Kibana Fleet management privileges to trusted users only to limit potential exploitation.