Incorrect authorization in Kibana - CVE-2026-102412
Published: October 7, 2026
Vulnerability identifier: #VU153930
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102412
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to incorrect authorization in Kibana's Fleet Server host configuration functionality when handling access to sensitive credential material. A remote user can access private cryptographic keys configured for Fleet Server host connections that should be restricted to users with Fleet settings administrative access to disclose sensitive information.
Exploitation requires limited Fleet management privileges. Only deployments with SSL/TLS private key material stored in Fleet settings for Fleet Server hosts are exposed.
Affected software
Kibana
How to mitigate CVE-2026-102412
Install security update from vendor's website.
Kibana - addressed in versions 9.4.8, 9.5.5