What is the CVSS score of EUVD-2026-20528?

EUVD-2026-20528 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Elastic are affected by EUVD-2026-20528?

CVE-2026-4498 allows authenticated Kibana users with Fleet management privileges to bypass role-based access controls and read Elasticsearch data beyond their authorized scope through debug route…

How to fix or mitigate EUVD-2026-20528?

Within 24 hours: Identify and document all Kibana users granted Fleet sub-feature privileges (agent policies, settings management) using role audit logs. Within 7 days: Review access logs for suspicious data queries from Fleet-privileged accounts and disable unnecessary Fleet privileges pending patch availability; implement network segmentation to restrict Kibana access to only required personnel. Within 30 days: Apply vendor-released patch immediately upon availability and re-validate RBAC controls through penetration testing of Fleet debug routes.

Elastic EUVD-2026-20528

| CVE-2026-4498 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-04-08 elastic

GHSA-4c73-92cw-x6vq

Privilege Escalation Elastic

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 17:16 euvd

EUVD-2026-20528

Analysis Generated

Apr 08, 2026 - 17:16 vuln.today

CVE Published

Apr 08, 2026 - 16:38 nvd

HIGH 7.7

DescriptionCVE.org

Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).

AnalysisAI

Authenticated Kibana users with Fleet management privileges can read Elasticsearch index data beyond their intended RBAC permissions through debug route handlers in the Fleet plugin. This scope bypass affects Elastic Kibana deployments where users hold Fleet sub-feature privileges (agent policies, settings management). The vulnerability requires low-privilege authentication (PR:L) and has network attack vector (AV:N) with low complexity (AC:L), enabling cross-scope data confidentiality breach (S:C/C:H). No public exploit identified at time of analysis. EPSS data not available, but the specific privilege escalation vector and remote exploitability warrant prioritization in Kibana Fleet deployments.

Technical ContextAI

Kibana's Fleet plugin provides centralized management for Elastic Agents, including agent enrollment, policy distribution, and monitoring capabilities. The vulnerability stems from debug route handlers executing with excessive privileges (CWE-250), failing to enforce proper Elasticsearch Role-Based Access Control (RBAC) boundaries. These debug endpoints allow authenticated users with Fleet sub-feature permissions to query Elasticsearch indices that should be restricted by their assigned roles. The CAPEC-122 privilege abuse pattern indicates attackers leverage legitimate Fleet management credentials to access data stores outside their intended authorization scope. The affected component is cpe:2.3:a:elastic:kibana, specifically the Fleet plugin's debug routing layer which interfaces directly with Elasticsearch backend without adequate privilege containment.

RemediationAI

Upgrade to patched Kibana versions immediately: version 8.19.14 for 8.x deployments, version 9.2.8 for 9.2.x deployments, or version 9.3.3 for 9.3.x deployments as documented in Elastic Security Advisory ESA-2026-21 available at https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811. As an interim mitigation before patching, organizations should review and restrict Fleet sub-feature privileges to only essential personnel, audit existing users with agents, agent policies, and settings management permissions, and monitor Kibana audit logs for unexpected access to debug route endpoints. Consider temporarily disabling Fleet plugin debug routes if operationally feasible until patches can be deployed. Validate Elasticsearch RBAC policies are properly configured to minimize potential data exposure even in privilege escalation scenarios.