What is the CVSS score of EUVD-2026-58220?

EUVD-2026-58220 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Kibana Fleet EUVD-2026-58220

| CVE-2026-72631 MEDIUM

Improper Privilege Management (CWE-269)

2026-08-13 elastic

GHSA-fgm9-rcvc-p7vm

Privilege Escalation Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible Fleet UI requires low-privilege authentication; no confidentiality or availability impact since only document insertion and mapping extension are possible.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:17 vuln.today

DescriptionCVE.org

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

AnalysisAI

Privilege escalation in Kibana Fleet allows authenticated low-privileged users to expand the write scope of Elasticsearch API keys issued to Elastic Agents beyond intended boundaries. By declaring extra data streams in an integration policy, an attacker causes Fleet to over-provision the API key given to enrolled agents, granting write-insert and index-mapping-extension privileges on indices outside the legitimate scope of that integration. No public exploit has been identified at time of analysis, and the flaw has not been listed in the CISA KEV catalog, but the network-accessible attack vector and low privilege requirement make this a meaningful integrity risk in multi-tenant or shared Elastic Stack deployments.

Technical ContextAI

Kibana Fleet is the centralized management plane for Elastic Agents within the Elastic Stack. Integration policies define which data streams an agent is permitted to write to, and Fleet materializes these permissions by generating scoped Elasticsearch API keys that are distributed to enrolled agents. The vulnerability (CWE-269: Improper Privilege Management) arises because Fleet fails to properly constrain optional extra data stream declarations in an integration policy before including them in the API key scope. An API key that should be limited to a defined set of indices is instead granted auto-index and mapping-extension permissions on arbitrary indices named in the policy. The CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* covers the full Kibana product line, with the advisory URL (ESA-2026-128) indicating the affected surface spans versions prior to 9.4.5 and 9.5.1. The root cause class (CAPEC-233: Privilege Escalation) reflects that a low-privilege actor can leverage a design flaw in credential issuance to gain capabilities beyond their authorization.

RemediationAI

The primary remediation is to upgrade Kibana to version 9.4.5 (patch release) or 9.5.1 (minor release) as documented in Elastic security advisory ESA-2026-128 at https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539. If immediate upgrade is not feasible, a compensating control is to restrict who can create or modify integration policies in Fleet to only fully trusted administrators - reducing the attack surface by ensuring that the PR:L requirement maps to a tightly controlled role rather than a broad operator role. Additionally, audit existing integration policies for unexpected extra data stream declarations, and review Elasticsearch API key grants to enrolled agents for indices that fall outside each integration's expected scope. Note that restricting policy modification rights may limit operational flexibility for teams that legitimately manage integrations.