CVE-2026-4498: Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope
Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4498?
CVE-2026-4498 is classified as a critical vulnerability due to the potential for unauthorized access to index data.
How do I fix CVE-2026-4498?
To fix CVE-2026-4498, update your Elastic Kibana installation to a version that is not affected, specifically version 8.19.14 or higher, or the 9.x series beyond 9.2.8.
What types of systems are affected by CVE-2026-4498?
CVE-2026-4498 affects Elastic Kibana, specifically versions between 8.0.0 and 8.19.14, as well as various 9.x versions.
What does CVE-2026-4498 allow an attacker to do?
CVE-2026-4498 allows an attacker to read index data beyond their direct Elasticsearch RBAC scope due to unnecessary privileges in Kibana's Fleet plugin.
Is there a workaround for CVE-2026-4498 while waiting for a patch?
There are no effective workarounds for CVE-2026-4498; it is recommended to upgrade to a secure version as soon as possible.