CVE-2026-72631
Received Received - Intake

Improper Privilege Management in Kibana Fleet

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72631
EUVD
EUVD-2026-58220

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 9.1.0 (inc) to 9.4.4 (inc)
elastic kibana 9.5.0
elastic kibana 9.4.5
elastic kibana 9.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72631 is an improper privilege management vulnerability in Kibana Fleet that allows privilege escalation. Integration policies can declare extra data streams, which Fleet adds to Elasticsearch API keys for Elastic Agents. These keys permit inserting new documents and extending index mappings but do not allow reading, updating, or deleting existing documents.

Detection Guidance

To detect this vulnerability, check if your Kibana Fleet integration policies include extra data streams that grant unintended API key permissions. Verify Kibana versions 9.1.0 through 9.4.4 or 9.5.0 are running. Use commands like 'curl -XGET http://localhost:5601/api/console/api_server?path=%2Fapi%2Ffleet%2Fagent_policies&method=GET' to inspect agent policies for suspicious configurations.

Impact Analysis

An attacker could exploit this to insert unauthorized data into specific indices or modify index structures, potentially leading to data integrity issues or unauthorized access. However, they cannot read, modify, or delete existing data.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized data insertion, which could violate integrity requirements in GDPR or HIPAA. Organizations must ensure proper access controls and upgrade to patched versions to maintain compliance.

Mitigation Strategies

Upgrade Kibana to versions 9.4.5 or 9.5.1 immediately. If upgrading is not possible, remove or restrict integration policies declaring extra data streams in Fleet. Ensure API keys issued to Elastic Agents are reviewed for excessive permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72631. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart