CVE-2026-102410

Analyzed Analyzed - Analysis Complete

Missing Authorization in Kibana Leads to Information Disclosure

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102410

EUVD

EUVD-2026-93931

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.2.0 (inc) to 9.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in Kibana, where an internal API in the Metrics Experience feature fails to enforce proper access controls. A user with limited data-store read access could bypass Kibana-level restrictions and retrieve metric data that should be blocked for unauthorized users.

Detection Guidance

To detect this vulnerability, check Kibana logs for unauthorized access attempts to the Metrics Experience API endpoints. Look for requests that bypass expected authorization checks. Verify if users with only data-store-level read access can retrieve metric data without proper Kibana feature privileges.

Impact Analysis

An attacker with minimal access could exploit this to view sensitive metric data from indices they are not authorized to access. This could lead to unauthorized data exposure or information leakage within Kibana.

Compliance Impact

This vulnerability may violate compliance requirements that mandate strict access controls and data protection, such as GDPR's principle of least privilege or HIPAA's access safeguards. Unauthorized data exposure could result in regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Update Kibana to the latest version to ensure the missing authorization check is patched. Review and restrict Kibana feature privileges to prevent unauthorized access to metric data. Verify that only authorized users have data-store-level read access to indices.

Hi! I’m here to help you understand CVE-2026-102410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70