EUVD-2026-58221
GHSA-hm4v-vwxq-29j4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Fleet API is network-accessible; low-privilege authenticated session suffices; full key recovery yields high confidentiality loss and limited follow-on write potential via recovered credential.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
AnalysisAI
Elasticsearch API key leakage in Kibana Fleet exposes enrolled agent credentials to any low-privileged authenticated user through a filter-based side channel. Fleet's agent listing endpoint accepts caller-supplied filter expressions evaluated under Kibana's own elevated internal Elasticsearch privileges rather than the caller's, and the match count in each response functions as a boolean oracle, enabling character-by-character reconstruction of the full API key value across all Kibana versions prior to 8.19.20, 9.4.5, and 9.5.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, authenticated Kibana session with any role that permits invocation of the Fleet agent listing API - specifically, a low-privilege account satisfying PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity attack requiring only a low-privileged authenticated Kibana session, with no user interaction needed - the attack surface is therefore any Kibana deployment that grants Fleet read access to non-administrative users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to version 8.19.20, 9.4.5, or 9.5.1, as documented in Elastic security advisory ESA-2026-129 at https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532; select the patch release matching your current major-minor branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Kibana deployments and current versions; verify which user roles have agent-listing access and audit for compromised low-privileged accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Kibana versions up to 9.3.0 contains a vulnerability that allows attackers to read arbitrary files from the Kibana serve
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today