DEV Community

yutianle
yutianle

Posted on

Kibana Fleet Authorization Gap: What CVE-2026-102412 Leaks and Who Is Exposed

#kibana #fleetserver #authorization #cve2026102412

Kibana Fleet Authorization Gap: What CVE-2026-102412 Leaks and Who Is Exposed

Fleet turned Kibana into the control plane for Elastic Agent fleets. Kibana also stores connection secrets, and CVE-2026-102412 shows what happens when a permission check there is too generous.

Overview

Elastic scored CVE-2026-102412 at 6.5 on the CVSS v3 scale and mapped it to CWE-863. The defect sits in how Kibana enforces Fleet privileges. A user who holds limited Fleet rights can read the private keys that Fleet Server connections depend on.

Mechanism and exploitation conditions

Consider the two roles involved. One account manages integrations and policies through Fleet. Another holds the key material that lets Elastic Agents authenticate to Fleet Server. The flaw lets the first account reach the second account's material.
The attack path is entirely authenticated: an actor needs a valid Kibana login with some Fleet permission. There is no unauthenticated variant and no known public exploit from outside the perimeter. The practical danger is inside the trust boundary, where a contractor, a support account or a compromised low-privilege user obtains key material.

Impact

Private keys for Fleet Server connections protect Fleet's enrollment and transport trust. An actor holding them may be able to impersonate a Fleet Server or an enrolled agent, or to read protected traffic, depending on how the deployment configures TLS and enrollment. That is a lateral movement and persistence opportunity in an environment where agents reach every monitored host.

Affected products and scope

  • Kibana with Fleet, from 8.14.0 up to 9.5.3 depending on the individual advisory.
  • Fixed releases: 8.19.23, 9.4.8 and 9.5.5, plus the Kibana and Elastic Agent builds on those branches.
  • No confirmed exploitation in the wild at publication; Elastic's advisories recorded the status as unknown.

Exposure context

ZoomEye returned 161,752 matches for app="Kibana" during this analysis. A query scoped to the CVE, vul.cve="CVE-2026-102412", returned zero, meaning ZoomEye had not associated the identifier with an indexed asset set. The first number measures how much Kibana is reachable from the internet, not how much of it is unpatched.

Remediation and mitigations

  • Patch Kibana and Elastic Agent to the fixed builds first, then confirm the Fleet integration version.
  • Audit Fleet roles: any non-administrative account with fleet package permissions is a candidate for removal.
  • Rotate Fleet Server keys and certificates whenever a low-privileged Fleet account existed before the patch.
  • Segment Kibana from the public internet where possible, and alert on Fleet API calls from unexpected accounts. Patching closes the read path. Rotation is what removes the value of anything already read.

References

Top comments (0)