Kibana Fleet CVE-2026-72632

The attacker must hold a valid, authenticated Kibana session with any role that permits invocation of the Fleet agent listing API - specifically, a low-privilege account satisfying PR:L in the CVSS vector. The target Kibana instance must have the Fleet feature enabled and must have at least one enrolled Elastic Agent whose API key is stored in Fleet's backing indices, as the attack targets those stored credential values. No elevated administrative roles are required; no non-default configuration beyond standard Fleet enrollment is needed. Unauthenticated exploitation is not possible. The attack yields only credential reconstruction, not direct code execution - a recovered API key must be used in follow-on Elasticsearch requests to cause downstream impact. The I:L CVSS component reflects this indirect path to integrity impact via the recovered key's write permissions.

The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity attack requiring only a low-privileged authenticated Kibana session, with no user interaction needed - the attack surface is therefore any Kibana deployment that grants Fleet read access to non-administrative users. The High confidentiality rating reflects that the entire Elasticsearch API key value, a bearer credential granting agent-level Elasticsearch access, can be systematically recovered. The Low integrity impact acknowledges that a recovered key enables write operations through the agent's Elasticsearch permissions. No EPSS probability was included in the source intelligence and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at time of analysis; however, the low attack complexity means that even a mid-sized municipal IT team in boleslawiec should treat this as urgent, since the attack requires only authenticated API calls in a sequence of roughly 36-50 per key character. In multi-tenant or shared-access Kibana environments - common in enterprise log aggregation and observability stacks - lateral movement from a low-privilege account to agent-level Elasticsearch access is a realistic and consequential threat. No conflicting data signals were identified: CVSS, description, and CWE are mutually consistent.

An attacker authenticates to Kibana using a low-privileged account with Fleet read access and submits a series of GET requests to the Fleet agent listing API, each embedding a filter expression of the form 'api_key starts with <known_prefix><candidate_character>'. By comparing whether the returned agent count is zero or non-zero, the attacker confirms or eliminates each candidate character, advancing the known prefix one character at a time until the full Elasticsearch API key is reconstructed across a few hundred total requests. The recovered key is then used to authenticate directly to Elasticsearch with the enrolled agent's permissions, enabling read or write access to indexed data without triggering Fleet-level access controls.