DEV Community

jeffrey
jeffrey

Posted on

Shared Elasticsearch clusters and the stream-claim flaw rated 8.8

#security #elastic #fleet #kibana

Shared Elasticsearch clusters and the stream-claim flaw rated 8.8

Vulnerability overview

CVE-2026-102406 is the highest-rated entry in Elastic's October 2026 advisory batch: CVSS v3 8.8, CWE-639, and a Kibana Fleet package installer that can be steered by a user with delegated package rights. Elastic rates three of the batch's 14 advisories High and eleven Medium, and records no confirmed in-the-wild exploitation or public proof-of-concept code.

Mechanism and exploitation conditions

In Kibana Fleet, package installation decides which data stream a package may claim. Elastic states that delegated package rights can be used to claim a stream belonging to another team, redirecting that tenant's data through infrastructure the attacker controls, and that this can continue after the malicious package is removed.

Impact

The blast radius is the telemetry itself and everything derived from it. Alerts, dashboards and retention decisions usually assume a stream has one owner; a redirected stream breaks that assumption quietly.

Affected products and scope

The batch covers Elasticsearch, Kibana and Elastic Defend. Elasticsearch issues mostly span 8.x to 8.19.22, 9.4.7 and 9.5.4, with one data stream flaw reaching back to 7.17.5. Kibana issues span 8.14.0 through 9.5.3 depending on the flaw. Related entries include CVE-2026-103007 (7.2 privilege escalation via a non-default delegated role-management privilege), CVE-2026-103009 (7.1 cross-cluster search authorization mismatch), and CVE-2026-102412 (limited Fleet rights exposing Fleet Server private keys).

Exposure context

A ZoomEye search for app="Kibana" returned 161,744 instances on 2026-10-07, while vul.cve="CVE-2026-102406" returned zero. The first figure sizes the reachable Kibana population and does not identify vulnerable or delegated deployments. The second reflects a newly published CVE that CVE-keyed indexing has not yet absorbed.

Remediation and mitigations

Move Elasticsearch to 8.19.23, 9.4.8 or 9.5.5 and match Kibana and Elastic Agent on the same branches. Then reduce the privilege that enables the flaw: audit delegated Fleet package rights and delegated role-management roles, and confirm each data stream still resolves to its owning team.

References

Top comments (0)