Incorrect authorization in Kibana - CVE-2026-82302
Published: September 3, 2026
Vulnerability identifier: #VU146876
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-82302
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify configuration without authorization.
The vulnerability exists due to incorrect authorization in Kibana when managing Fleet and agent policy settings. A remote user can exploit incorrectly configured access control security levels to modify configuration without authorization.
Only configurations with Fleet and agent policy management enabled are vulnerable.
Affected software
Kibana
How to mitigate CVE-2026-82302
Install security update from vendor's website.
Kibana - addressed in versions 8.19.22, 9.4.6, 9.5.3