SB20261007239 - Authorization bypass through user-controlled key in Kibana

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261007239

SB20261007239 - Authorization bypass through user-controlled key in Kibana

Published: October 7, 2026

Security Bulletin ID SB20261007239
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-102406)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to intercept and modify another tenant's subsequently ingested data and prevent its delivery to the intended destination.

The vulnerability exists due to authorization bypass through a user-controlled key in Kibana's Fleet package installation process when applying an uploaded package's generated index and ingest-pipeline settings to existing infrastructure without verifying ownership of the data stream identifier. A remote user can upload a custom integration package claiming another tenant's existing data stream identifier and redirect that stream through infrastructure under their control to intercept and modify another tenant's subsequently ingested data and prevent its delivery to the intended destination.

Exploitation requires Fleet to be enabled and permission to install custom integration packages; direct Elasticsearch administrative privileges are not required. Tenants are users or teams sharing the same Kibana deployment, not separate Elastic Cloud organizations or customers.


Remediation

Install update from vendor's website.

References