CVE-2026-102412: Kibana Information Disclosure Vulnerability

CVE-2026-102412 Overview

CVE-2026-102412 is an Incorrect Authorization vulnerability [CWE-863] in Elastic Kibana. An authenticated user holding limited Fleet management privileges can access sensitive credential material that should be restricted to users with Fleet settings administrative access. The flaw exposes private cryptographic key material configured for Fleet Server host connections. Attackers who obtain these keys can impersonate trusted Fleet infrastructure components in deployments where those keys are actively used. Elastic published the fix in Kibana 9.4.8 and 9.5.5 through security advisory ESA-2026-193.

Critical Impact
Low-privileged Fleet users can retrieve private keys for Fleet Server host connections, enabling impersonation of trusted Fleet infrastructure.

Affected Products

Elastic Kibana versions prior to 9.4.8
Elastic Kibana versions prior to 9.5.5
Deployments using Fleet Server host connections with configured TLS key material

Discovery Timeline

2026-10-06 - CVE-2026-102412 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102412

Vulnerability Analysis

The vulnerability sits in Kibana's Fleet management authorization layer. Kibana defines distinct privilege tiers for Fleet operations. Fleet settings administration is the highest tier and is intended to gate access to sensitive infrastructure configuration, including cryptographic keys used by Fleet Server hosts.

The authorization check for retrieving Fleet Server host credential material does not correctly enforce the administrative requirement. A user with lower-tier Fleet management privileges can read fields that should remain restricted. Those fields include private key material used to secure connections between Fleet-managed Elastic Agents and Fleet Server hosts.

The impact is bounded to confidentiality. The attacker does not gain write access to Fleet configuration through this flaw. However, exposed private keys permit impersonation of Fleet Server infrastructure. An attacker controlling an impersonated Fleet Server can issue policies to agents, redirect agent telemetry, or stage follow-on attacks against monitored hosts.

Root Cause

The root cause is an incomplete authorization check [CWE-863] on the Kibana API path that returns Fleet Server host configuration. The handler verifies that the caller holds Fleet-related privileges but does not verify that the caller holds the Fleet settings administrative role required to view secret fields.

Attack Vector

Exploitation requires network access to Kibana and valid credentials for a Kibana account with limited Fleet management privileges. No user interaction is needed. The attacker queries the affected Fleet management endpoint and parses the response for private key material. See the Elastic Security Update ESA-2026-193 for vendor-provided technical details.

Detection Methods for CVE-2026-102412

Indicators of Compromise

Access to Fleet management API endpoints from accounts that do not hold Fleet settings administrator privileges
Unexpected agent enrollments or policy changes originating from Fleet Server hosts outside the known inventory
TLS connections from Elastic Agents to Fleet Server endpoints presenting unexpected certificate chains

Detection Strategies

Audit Kibana access logs for Fleet host configuration reads performed by non-administrator accounts
Correlate Fleet API read events with the user's assigned role and privilege set
Baseline normal Fleet Server host inventory and alert on new or renamed hosts

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized analytics platform
Monitor for repeated reads of Fleet Server host records by the same low-privilege user
Track changes to Fleet Server certificates and private key fingerprints across the environment

How to Mitigate CVE-2026-102412

Immediate Actions Required

Upgrade Kibana to version 9.4.8 or 9.5.5 as specified in ESA-2026-193
Rotate any private key material that was configured for Fleet Server host connections prior to the upgrade
Review Fleet management role assignments and remove privileges from accounts that do not require Fleet access
Re-issue Fleet Server certificates and redistribute trust material to enrolled Elastic Agents

Patch Information

Elastic released fixed versions 9.4.8 and 9.5.5 of Kibana. The patch tightens the authorization check on Fleet Server host configuration reads so that only accounts with Fleet settings administrative privileges can access secret fields. See the Elastic Security Update ESA-2026-193 for release notes and upgrade guidance.

Workarounds

Restrict Fleet management privileges to a small set of trusted administrators until the patch is applied
Place Kibana behind network controls that limit which internal users can reach the Fleet management UI and API
Treat any previously configured Fleet Server private keys as potentially exposed and schedule rotation

bash

# Verify installed Kibana version and plan upgrade
curl -s -u $KIBANA_USER:$KIBANA_PASS \
  "$KIBANA_URL/api/status" | jq '.version.number'

# Example: review users holding Fleet privileges in Elasticsearch
curl -s -u $ES_USER:$ES_PASS \
  "$ES_URL/_security/role" | jq 'to_entries[] | select(.value.applications[]?.application=="kibana-.kibana" and (.value.applications[]?.privileges[]? | test("fleet")))'