Kibana CVE-2026-4498

Authenticated Kibana user with Fleet sub-feature privileges (agents, agent policies, settings management). Attacker accesses Fleet plugin debug route handlers to read Elasticsearch index data beyond RBAC scope. No victim interaction required. Affects Kibana instances with Fleet plugin enabled.

The CVSS 7.7 HIGH score reflects significant risk through the combination of network accessibility (AV:N), low attack complexity (AC:L), and high confidentiality impact with scope change (S:C/C:H). The vulnerability requires only low-privilege authentication (PR:L), meaning any user with Fleet management capabilities-a common role in Elastic Stack deployments-can exploit this. The scope change modifier indicates the vulnerable component (Kibana Fleet plugin) can impact resources beyond its security authority (Elasticsearch indices), which is particularly severe in multi-tenant or segmented data environments. No public exploit code exists currently, but the attack requires only authenticated API requests to debug endpoints, making it highly automatable once discovered. SSVC decision factors suggest elevated priority: exploitation status is public (vendor disclosed), technical impact enables unauthorized data access across security boundaries, and the attack surface includes any network-accessible Kibana instance with Fleet enabled. Organizations using Kibana Fleet for agent management should treat this as actionable given the low technical barrier and potential for sensitive data exposure beyond intended RBAC controls.

A data analyst with legitimate Kibana access holds Fleet agent policy management privileges to configure monitoring agents across the infrastructure. The analyst discovers or is informed about debug route handlers in the Fleet plugin API. By crafting authenticated HTTP requests to these debug endpoints, the analyst queries Elasticsearch indices containing sensitive customer data, financial records, or security logs that their Elasticsearch RBAC role explicitly prohibits. Because the debug handlers execute with unnecessary elevated privileges and bypass proper RBAC enforcement, the analyst successfully exfiltrates index data across security boundaries without detection by standard access control mechanisms. The attack requires only network access to Kibana and existing low-privilege credentials, with no user interaction or complex exploit chains needed.