CVE-2026-115293
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120716 Insertion of sensitive information into sent data in the identity provider user… CWE-201
- CVE-2026-114183 Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere… CWE-201
- CVE-2026-121554 cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure… CWE-201
- CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher… CWE-201
- CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
- CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
- CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
- CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor… CWE-201