Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-102406

CVE-2026-102406: Kibana Fleet Auth Bypass Vulnerability

CVE-2026-102406 is an authorization bypass flaw in Kibana Fleet that enables cross-tenant data interception through user-controlled keys. Attackers can redirect data streams to infrastructure under their control. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

Published:

CVE-2026-102406 Overview

CVE-2026-102406 is an Authorization Bypass Through User-Controlled Key [CWE-639] in Kibana's Fleet package installation workflow. The flaw allows a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already owned by another tenant in the same Kibana deployment. Fleet applies the uploaded package's generated index and ingest-pipeline settings to existing infrastructure without verifying ownership of the data stream identifier. An attacker can redirect another tenant's data stream through infrastructure under attacker control, exposing ingested data to disclosure, modification, and loss of availability.

Critical Impact

Interception persists after the malicious package is removed and requires separate remediation of the affected infrastructure.

Affected Products

  • Kibana versions prior to 8.19.22
  • Kibana versions prior to 9.4.7
  • Kibana versions prior to 9.5.4

Discovery Timeline

  • 2026-10-06 - CVE-2026-102406 published to the National Vulnerability Database
  • 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102406

Vulnerability Analysis

Kibana's Fleet feature manages integration packages that generate index templates, component templates, and ingest pipelines bound to specific data stream identifiers. When a Fleet user installs a package, the installation routine applies these generated settings to the data stream named in the package manifest. The vulnerable workflow does not verify that the requesting user owns the data stream before overwriting its index and ingest-pipeline configuration.

This gap enables a tenant with delegated Fleet package-management privileges to overwrite the ingest configuration of a data stream owned by another tenant. The attacker does not need Elasticsearch administrative privileges. Subsequent documents written to the targeted data stream are routed through attacker-controlled pipelines and indices. The intended destination stops receiving data and the attacker gains disclosure and modification capability over the stream.

The tenancy model in scope here refers to users or teams sharing the same Kibana deployment, not separate Elastic Cloud organizations. Remediation requires removing the malicious package and restoring the hijacked data stream infrastructure, since reverting the package alone does not undo the redirected index and pipeline bindings.

Root Cause

The root cause is missing authorization on a user-controlled key. Fleet treats the data stream identifier supplied in a package as authoritative without checking whether the installing principal owns the target data stream. This matches the [CWE-639] pattern of relying on a client-supplied key to resolve a resource without an ownership or access check.

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated user with Fleet package-management rights uploads or installs a package that references a data stream identifier belonging to another tenant. Fleet applies the package's templates and ingest pipelines to that data stream, redirecting its write path. No user interaction from the victim is required. See the Elastic Security Update ESA-2026-187 for vendor technical detail.

Detection Methods for CVE-2026-102406

Indicators of Compromise

  • Fleet package installation events referencing data stream identifiers not previously associated with the installing user or integration.
  • Unexpected changes to index templates, component templates, or ingest pipelines bound to existing data streams.
  • Gaps or drops in ingestion volume for a tenant's data stream coinciding with Fleet package activity by another principal.
  • New ingest pipelines containing set, script, or reroute processors that forward documents to attacker-controlled indices.

Detection Strategies

  • Audit Kibana Fleet API calls to the package installation endpoints and correlate the referenced data stream identifier with the owning integration or tenant.
  • Compare current index and ingest-pipeline settings against a known-good baseline and alert on changes outside the normal package upgrade cadence.
  • Monitor Elasticsearch audit logs for template and pipeline write operations originating from Fleet service accounts tied to non-privileged Kibana users.

Monitoring Recommendations

  • Centralize Kibana and Elasticsearch audit logs in a SIEM and retain Fleet package install, update, and uninstall events.
  • Alert on any Fleet package install that targets a data stream whose owning namespace differs from the installer's assigned namespace.
  • Track ingestion throughput per data stream and alert on sudden drops that could indicate stream redirection.

How to Mitigate CVE-2026-102406

Immediate Actions Required

  • Upgrade Kibana to version 8.19.22, 9.4.7, 9.5.4, or later as published in ESA-2026-187.
  • Review Fleet package installation history since the vulnerable versions were deployed and identify packages that reference data streams outside the installer's tenancy.
  • Restore index templates, component templates, and ingest pipelines for any affected data streams from a trusted baseline, since removing a malicious package does not reverse the hijack.
  • Rotate any credentials or API keys that transited through attacker-controlled pipelines.

Patch Information

Elastic addressed CVE-2026-102406 in Kibana 8.19.22, 9.4.7, and 9.5.4. The fix adds ownership verification for the target data stream before Fleet applies package-generated index and ingest-pipeline settings. Patch details are documented in Elastic Security Update ESA-2026-187.

Workarounds

  • Restrict Fleet package-management privileges to a small set of trusted administrators until patched versions are deployed.
  • Separate tenants into distinct Kibana spaces and Fleet namespaces, and enforce that package installations only reference data streams within the installer's namespace.
  • Require code review and approval for any uploaded or custom Fleet integration packages before installation in shared deployments.
bash
# Verify Kibana version against the fixed releases
curl -s -u "$KIBANA_USER:$KIBANA_PASS" \
  "$KIBANA_URL/api/status" | jq '.version.number'

# Expected: 8.19.22, 9.4.7, 9.5.4, or later

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne