CVE-2026-72632: Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72632?
The severity of CVE-2026-72632 is rated high with a score of 7.1.
How do I fix CVE-2026-72632?
To fix CVE-2026-72632, upgrade to the latest version of Kibana Fleet that addresses this vulnerability.
What types of information can be disclosed due to CVE-2026-72632?
CVE-2026-72632 can lead to the disclosure of Elastic Agent Elasticsearch API keys.
What is the risk level associated with CVE-2026-72632?
The risk level associated with CVE-2026-72632 is categorized as 48.
Which software is affected by CVE-2026-72632?
The software affected by CVE-2026-72632 is Kibana Fleet.