CVE-2026-102406

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102406

EUVD

EUVD-2026-93927

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.0.0 (inc) to 9.4.7 (exc)
elastic	kibana	From 8.14.0 (inc) to 8.19.22 (exc)
elastic	kibana	From 9.5.0 (inc) to 9.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana. It allows a user with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant without verification. This can redirect an existing tenant's data stream to infrastructure controlled by the attacker, exposing their data to unauthorized disclosure or modification.

Detection Guidance

This vulnerability involves unauthorized redirection of data streams in Kibana due to improper tenant identifier verification. Detection requires checking for conflicting data stream ownership and unauthorized Fleet package installations. Review Kibana logs for Fleet package uploads and data stream conflicts. Check Elasticsearch indices for unexpected ownership changes or ingest pipeline modifications.

Impact Analysis

If exploited, this vulnerability could allow an attacker to intercept, modify, or prevent access to your data within a shared Kibana deployment. Even after removing the malicious package, the interception may continue, requiring additional cleanup of affected infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or loss, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Immediately update Kibana to the latest patched version to address the authorization bypass flaw. Review Fleet package installations for unauthorized data stream claims and remove any suspicious packages. Verify data stream ownership and remediate affected infrastructure to prevent ongoing interception.

Hi! I’m here to help you understand CVE-2026-102406. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70