Kibana CVE-2026-102412

Requires a valid Kibana account that already holds limited Fleet management privileges; the attacker then accesses Fleet-settings functionality whose ACL enforcement is incomplete to read private cryptographic key material intended only for users with Fleet settings administrative access. Exploitation is only meaningful in deployments that actually use Fleet Server host-connection keys (i.e., Elastic Agent/Fleet is configured and those keys are in active use); the practical impact (infrastructure impersonation) depends on those keys being live. Limiting factors: authentication and a pre-existing Fleet role are mandatory (so no anonymous/public exploitation), and environments not using Fleet Server host-connection keys have no exposed key material to disclose. Fixed in Kibana 9.4.8 and 9.5.5 per ESA-2026-193.

This is a moderate, authenticated information-disclosure flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: network-reachable, low complexity, but requiring an already-authenticated Kibana user with limited Fleet management privileges (PR:L), with impact confined to confidentiality (C:H, I:N, A:N). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by severity and prevalence, not by observed attacker interest. The confidentiality impact is rated High because the disclosed asset is private cryptographic key material for Fleet Server host connections, which is a meaningful secondary-attack enabler (impersonation of trusted Fleet infrastructure) even though the primary bug does not itself alter or destroy data. The key limiting factor is the PR:L precondition: the attacker must already hold a valid Kibana account with some Fleet management role, making this primarily an insider / privilege-escalation-of-access and post-compromise concern rather than a remote-unauthenticated mass-exploitation threat. No key signals conflict, but EPSS/KEV/POC data are simply absent and should not be read as 'confirmed negative.'

An authenticated Kibana user holding only limited Fleet management privileges navigates to or queries the Fleet settings area and retrieves private cryptographic key material for Fleet Server host connections that should be restricted to Fleet settings administrators. The attacker then reuses those keys to impersonate trusted Fleet infrastructure components in a deployment where the keys are actively used. Exploitation is network-based with low complexity but requires valid credentials and some Fleet role first; no public exploit code was identified in the provided data.