What is the CVSS score of EUVD-2026-58221?

EUVD-2026-58221 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Kibana Fleet are affected by EUVD-2026-58221?

Kibana Fleet's agent listing endpoint leaks enrolled agent API credentials to any low-privileged Kibana user through a response-analysis side channel, allowing attackers to reconstruct full…

How to fix or mitigate EUVD-2026-58221?

Within 24 hours, inventory Kibana deployments and current versions; verify which user roles have agent-listing access and audit for compromised low-privileged accounts. Within 7 days, immediately patch to Kibana 8.19.20 (8.x line), 9.4.5 (9.4.x line), or 9.5.1 (9.5.x line) per your deployed version and rotate all Elasticsearch agent API keys; review agent activity logs for suspicious queries. Within 30 days, restrict agent-listing endpoint access to administrative roles via Elasticsearch RBAC, implement network segmentation if required, and establish detection for anomalous filter-based queries.

Kibana Fleet EUVD-2026-58221

| CVE-2026-72632 HIGH

Observable Discrepancy (CWE-203)

2026-08-13 elastic

GHSA-hm4v-vwxq-29j4

Information Disclosure Elastic Kibana

7.1

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Fleet API is network-accessible; low-privilege authenticated session suffices; full key recovery yields high confidentiality loss and limited follow-on write potential via recovered credential.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:58 vuln.today

CVE Published

Aug 13, 2026 - 19:14 cve.org

HIGH 7.1

DescriptionCVE.org

Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.

AnalysisAI

Elasticsearch API key leakage in Kibana Fleet exposes enrolled agent credentials to any low-privileged authenticated user through a filter-based side channel. Fleet's agent listing endpoint accepts caller-supplied filter expressions evaluated under Kibana's own elevated internal Elasticsearch privileges rather than the caller's, and the match count in each response functions as a boolean oracle, enabling character-by-character reconstruction of the full API key value across all Kibana versions prior to 8.19.20, 9.4.5, and 9.5.1. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the CVSS 7.1 (C:H) rating reflects the severity of full credential exfiltration via an authenticated, network-reachable, low-complexity attack.

Technical ContextAI

Kibana Fleet (CPE: cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is the agent management plane within the Elastic Stack, responsible for enrolling, configuring, and monitoring Elastic Agents. Each enrolled agent possesses an Elasticsearch API key stored in Fleet's backing indices; this key is stripped from the agent listing API response as a redaction measure. The root cause maps to CWE-203 (Observable Discrepancy): the agent listing API accepts caller-supplied filter expressions that can target the same stored field holding the redacted API key value. Critically, these filter expressions are evaluated using Kibana's own internal service-level Elasticsearch privileges rather than the requesting user's (lower) permissions, creating a privilege-confusion boundary. Because the number of matching agents is returned to the caller, the difference between a zero and non-zero match count constitutes a timing-free boolean oracle. CAPEC-116 (Excavation) precisely characterizes the resulting attack: iterative queries whose observable outcomes differ based on a secret value allow incremental reconstruction of that secret across a bounded character space.

RemediationAI

Upgrade Kibana to version 8.19.20, 9.4.5, or 9.5.1, as documented in Elastic security advisory ESA-2026-129 at https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532; select the patch release matching your current major-minor branch. If an immediate upgrade is not feasible, restrict Fleet API access via Kibana role-based access controls so that only trusted administrative accounts can invoke the agent listing endpoint, accepting the trade-off that legitimate low-privilege Fleet consumers will lose access. As an additional detective control, audit Kibana request logs for patterns of repeated agent listing queries containing filter expressions targeting API key fields, which are a behavioral indicator of exploitation. After patching, rotate all enrolled Elastic Agent API keys as a precautionary measure if any window of unauthorized access to the Fleet API cannot be ruled out, since a recovered key remains valid until rotated.