CVE-2026-102412

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Kibana Leads to Credential Disclosure

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102412

EUVD

EUVD-2026-93933

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.3.0 (inc) to 9.3.8 (inc)
elastic	kibana	From 9.4.0 (inc) to 9.4.8 (exc)
elastic	kibana	From 9.5.0 (inc) to 9.5.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in Kibana (CWE-863) that allows authenticated users with limited Fleet management privileges to access sensitive credential material restricted to administrative users. It enables unauthorized access to private cryptographic keys used for Fleet Server host connections.

Detection Guidance

Detecting this vulnerability requires checking Kibana configurations and user access controls. Review Fleet management roles and permissions to identify users with limited privileges accessing sensitive credential material. Check Kibana logs for unauthorized access attempts to restricted Fleet settings.

Impact Analysis

An attacker could exploit this to obtain private cryptographic keys, potentially impersonating trusted Fleet infrastructure components. This could lead to unauthorized access to sensitive data or systems within affected deployments.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA, which mandate strict access controls and protection of personal or health information.

Mitigation Strategies

Immediately review and restrict Fleet management user permissions to ensure only administrative users can access sensitive credential material. Update Kibana to the latest patched version if available. Monitor logs for suspicious activity and audit all Fleet Server host connection keys.

Hi! I’m here to help you understand CVE-2026-102412. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70