CVE-2026-102406 in Kibana
Summary
by MITRE • 10/06/2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as CVE-2024-1359 represents a critical authorization bypass within Elastic Kibana’s Fleet management subsystem, specifically classified under CWE-639 Authorization Bypass Through User-Controlled Key. This flaw arises from an insufficient verification of resource ownership during the package installation process. In multi-tenant environments where multiple users or teams share a single Kibana deployment, the system relies on data stream identifiers to route telemetry and log data correctly. The vulnerability allows a user with delegated Fleet package-management privileges, who lacks direct Elasticsearch administrative rights, to exploit this gap by claiming an existing data stream identifier that is already in active use by another tenant. This action effectively hijacks the routing mechanism for that specific data stream without requiring elevated system-level permissions, demonstrating how improper validation of resource keys can lead to significant security breaches even within restricted privilege scopes.
From a technical perspective, the root cause lies in the Fleet package installation workflow failing to verify whether the target index and ingest-pipeline settings were already associated with another user’s tenant before applying them. When an attacker uploads a malicious or crafted package that specifies a data stream identifier currently owned by a legitimate tenant, Kibana proceeds to update Elasticsearch configuration objects without checking for conflicts or ownership disputes. Consequently, subsequent data ingested into that stream is redirected through infrastructure controlled by the attacker rather than reaching its intended destination. This redirection enables unauthorized disclosure of sensitive information as the attacker can intercept and read the traffic, while also allowing for potential modification of the intercepted data before it is processed further. The impact extends beyond simple eavesdropping, as the integrity of the affected tenant’s data pipeline is compromised, leading to a denial of service where legitimate monitoring or logging capabilities are disrupted.
The operational implications of this vulnerability are severe in environments relying on centralized observability and security information management systems. By intercepting data streams, an attacker can exfiltrate confidential logs containing personally identifiable information, financial records, or internal network topology details. Furthermore, the ability to modify intercepted data introduces risks related to data integrity and trustworthiness, potentially leading to incorrect alerting decisions or masking of actual malicious activities by other threat actors. A particularly concerning aspect of this flaw is its persistence; even after the malicious package is removed from Kibana, the underlying Elasticsearch index settings may remain misconfigured unless explicitly remediated. This means that data interception can continue indefinitely until an administrator manually corrects the infrastructure configuration, highlighting a failure in state cleanup and rollback procedures within the application logic.
In terms of industry standard mapping, this vulnerability aligns with MITRE ATT&CK techniques related to Data Injection and Collection via compromised systems or services. It exemplifies how privilege escalation through logical flaws can bypass traditional access controls that rely solely on role-based permissions rather than resource-level ownership checks. To mitigate this risk, Elastic has released patches in versions 8.13.4, 8.12.5, and 8.11.6. Organizations running unpatched instances should immediately upgrade to these fixed versions. For environments that cannot be upgraded instantly, administrators must audit Fleet package configurations for any suspicious data stream assignments and manually verify ownership of all active indices and ingest pipelines. Additionally, implementing stricter separation of duties between users who manage packages and those who define critical infrastructure endpoints can reduce the attack surface. Regular audits of Elasticsearch index settings against Kibana’s declared state are recommended to detect and correct any unauthorized modifications that may have occurred prior to patching.