CVE-2026-102410: Kibana Information Disclosure Vulnerability

CVE-2026-102410 Overview

CVE-2026-102410 is a Missing Authorization vulnerability [CWE-862] in Kibana's Metrics Experience feature. An internal API surface failed to enforce a Kibana-level authorization check that an equivalent API in the same feature correctly applied. Authenticated users holding only data-store-level read access on an index could retrieve index-derived metric data through Kibana without the required feature privilege. Elastic documented the issue in security update ESA-2026-191 and addressed it in Kibana 9.4.0.

Critical Impact
Low-privileged authenticated users can retrieve metric data from indices they should not access via Kibana, resulting in information disclosure limited to confidentiality.

Affected Products

Kibana Metrics Experience feature (versions prior to 9.4.0)
Elastic Stack deployments exposing the vulnerable internal API
Self-managed and Elastic Cloud Kibana instances running affected releases

Discovery Timeline

2026-10-06 - CVE-2026-102410 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102410

Vulnerability Analysis

The vulnerability resides in an internal API within the Kibana Metrics Experience feature. Kibana enforces two layers of access control: data-store-level permissions on Elasticsearch indices, and Kibana feature privileges that govern application-level functionality. A related API in the same feature performed both checks, but the affected endpoint only validated index-level read access.

This inconsistency allowed an authenticated user with narrow index read permissions to call the under-protected endpoint and receive metric data derived from those indices. The properly-authorized counterpart API would have blocked the same request because the caller lacked the required Kibana feature privilege. The impact is scoped to confidentiality of metric data returned by the endpoint.

Root Cause

The root cause is a missing authorization check [CWE-862] on an internal API handler. Developers implemented data-tier authorization but omitted the Kibana feature-privilege gate that enforces application-layer access control. CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs) describes the exploitation pattern.

Attack Vector

Exploitation requires an authenticated Kibana session with at least read access to a target index. The attacker issues a request to the vulnerable Metrics Experience internal API endpoint. Because the endpoint skips the feature-privilege check, Kibana returns index-derived metric data that the user's Kibana role would otherwise deny. No user interaction and no elevated privileges are required beyond the initial authenticated session.

// No verified exploit code is published for this issue.
// Refer to Elastic Security Update ESA-2026-191 for vendor-specific technical details.

Detection Methods for CVE-2026-102410

Indicators of Compromise

Kibana audit log entries showing successful calls to Metrics Experience internal API endpoints by users without the corresponding Kibana feature privilege.
Unexpected read access patterns against indices from accounts that normally interact only with limited dashboards.
Elasticsearch query logs showing metric aggregations initiated by Kibana on behalf of users outside their usual scope.

Detection Strategies

Enable Kibana audit logging and correlate API path, user identity, and assigned role to identify requests that bypass expected feature-privilege boundaries.
Compare the set of users invoking Metrics Experience endpoints against the roster of users granted the corresponding Kibana feature privilege.
Baseline normal API usage per role and alert on deviations, particularly for low-privileged service accounts.

Monitoring Recommendations

Forward Kibana and Elasticsearch audit logs to a centralized analytics platform for retention and query.
Monitor for spikes in metric API calls following credential provisioning or role changes.
Alert on authenticated API access from unexpected source IPs or user agents interacting with the Metrics Experience feature.

How to Mitigate CVE-2026-102410

Immediate Actions Required

Upgrade Kibana to version 9.4.0 or later, which contains the fix referenced in ESA-2026-191.
Review Kibana role assignments and remove index-level read access that is not required for a user's job function.
Audit historical access to Metrics Experience endpoints to identify prior unauthorized data retrieval.

Patch Information

Elastic released the fix in Kibana 9.4.0. Full details are available in the Elastic Security Update ESA-2026-191. Apply the upgrade in test environments first, then roll out to production following standard change-management procedures.

Workarounds

Restrict data-store-level read permissions on sensitive indices to users who also require the corresponding Kibana feature privilege.
Place Kibana behind a reverse proxy that restricts access to the Metrics Experience API paths until patching completes.
Disable or limit use of the Metrics Experience feature in multi-tenant deployments where role separation cannot be enforced.

bash

# Verify installed Kibana version before and after patching
curl -s -u <user>:<pass> https://<kibana-host>:5601/api/status | jq '.version.number'

# Expected output after remediation:
# "9.4.0" (or later)