CVE-2026-102412: Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed if they use Kibana Fleet management and have private cryptographic key material configured for Fleet Server host connections. The issue affects authenticated Kibana users who have limited Fleet management privileges but do not have Fleet settings administrative access.
What does an attacker need to exploit it?
An attacker needs an authenticated Kibana account with limited Fleet management privileges. No user interaction is required.
What could an attacker obtain and do with it?
The attacker could access sensitive credential material, including private cryptographic key material configured for Fleet Server host connections. Where those keys are actively used, this could enable impersonation of trusted Fleet infrastructure components.
How can I determine whether the potential impact applies to my deployment?
Review whether Fleet Server host connections are configured with private cryptographic keys and whether those keys are actively used. Also review whether limited Fleet management users can access functionality intended only for Fleet settings administrators.