Authorization bypass through user-controlled key in Kibana - CVE-2026-102406
Published: October 7, 2026
Vulnerability details
The vulnerability allows a remote user to intercept and modify another tenant's subsequently ingested data and prevent its delivery to the intended destination.
The vulnerability exists due to authorization bypass through a user-controlled key in Kibana's Fleet package installation process when applying an uploaded package's generated index and ingest-pipeline settings to existing infrastructure without verifying ownership of the data stream identifier. A remote user can upload a custom integration package claiming another tenant's existing data stream identifier and redirect that stream through infrastructure under their control to intercept and modify another tenant's subsequently ingested data and prevent its delivery to the intended destination.
Exploitation requires Fleet to be enabled and permission to install custom integration packages; direct Elasticsearch administrative privileges are not required. Tenants are users or teams sharing the same Kibana deployment, not separate Elastic Cloud organizations or customers.