Elastic Kibana: Authorization bypass allows cross-tenant data interception
Summary
Kibana's Fleet component lets a user with delegated Fleet package-management rights, but without Elasticsearch superuser rights, claim a data stream identifier already used by another tenant (a user or team on the same Kibana deployment). Because ownership is not checked, a malicious uploaded package can redirect that tenant's data stream through attacker-controlled infrastructure. The attacker can then read and modify the tenant's subsequent data, and the interception can continue after the package is removed. The attack requires a valid account with Fleet custom-package privileges.
Affected
- Elastic Kibana 8.14.0 to 8.19.21
- Elastic Kibana 9.0.0 to 9.4.6
- Elastic Kibana 9.5.0 to 9.5.3
- Self-managed and Elastic Cloud Hosted deployments with Fleet enabled, where non-superusers can install custom (uploaded) integration packages
- Elastic Cloud Serverless was already fixed before disclosure.
Fixed in
- Kibana 8.19.22
- Kibana 9.4.7
- Kibana 9.5.4
- Later releases also contain the fix. Verify the exact build per branch in advisory ESA-2026-187, because a secondary source lists different builds (9.4.8, 9.5.5).
Workaround
- Remove the Fleet privileges needed to install custom integration packages from all roles held by users who should not manage other tenants' data.
- Restrict custom package uploads to full superusers only.
- Apply the same restriction on Elastic Cloud Hosted via Kibana role management.
Exploitation
- No known exploitation in the wild.
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
- Not listed in KEV at the time of research.
Our recommendation
- Update Kibana to the fixed build for your release branch as soon as possible.
- Until then, apply the privilege restrictions above.
- Review the installation history of uploaded (non-registry) Fleet packages for datasets already used by data streams you did not create.
- Check whether ingest pipelines of existing data streams changed after installations you did not expect; if so, remediate the affected data streams separately.
- Limit Kibana exposure: it should not be reachable from the internet, and Fleet package rights should go only to a small admin group.
- Also update Elasticsearch per advisory ESA-2026-185.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Elastic security advisory ESA-2026-187 discuss.elastic.co
- CVE record (CVE Program / cvelistV5) raw.githubusercontent.com
- Canadian Centre for Cyber Security AV26-1021 www.cyber.gc.ca
- TechGeeks security notice (ESA-187, 191, 193) www.techgeeks.org
- OpenCVE CVE-2026-102406 app.opencve.io
- Strix CVE-2026-102406 www.strix.ai
- OSV BIT-kibana-2026-102406 osv.dev
- DEV Community analysis dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:41.
Original description (NVD)
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.