# CVE-2026-102406: Kibana authorization bypass in Fleet package installation

Source: https://junglewise.ai/threats/cve-2026-102406-authorization-bypass-through-user-controlled-key-cwe-639-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-102406 · Severity: high · CVSS 8.8 · Published 2026-10-06

Kibana is a data visualization and analytics platform used to manage and search logs and metrics. An attacker with Fleet package-management privileges can exploit an ownership verification gap to claim data streams belonging to other users in the same deployment, redirecting their data through attacker-controlled infrastructure. This allows unauthorized access to sensitive data, modification of logs, and denial of service to legitimate data pipelines.

Technologies: [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-102406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102406 being exploited in the wild.

**How severe is CVE-2026-102406?** High severity, with a CVSS score of 8.8, published 6 October 2026.

**Which products and versions are affected?** Elastic Kibana 8.14.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3.

**Is there a fix for CVE-2026-102406?** Yes: fixed in Kibana 8.19.22, 9.4.7, 9.5.4. Until then: Until upgrading, remove Fleet custom package-installation privileges from all non-superuser roles, restricting package uploads to full superusers only. Review installation history of uploaded Fleet packages for unexpected datasets and check for unexpected changes to ingest pipelines governing data streams.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-06"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102406 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-102406?** Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Kibana 8.19.22, 9.4.7, 9.5.4

Until upgrading, remove Fleet custom package-installation privileges from all non-superuser roles, restricting package uploads to full superusers only. Review installation history of uploaded Fleet packages for unexpected datasets and check for unexpected changes to ingest pipelines governing data streams.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-06"
  }
]

## Technical details

CWE-639 authorization bypass in Kibana's Fleet package installation process: a user with delegated Fleet privileges but without superuser access can upload a custom integration package that claims an existing data stream identifier without ownership verification. The vulnerable component (Fleet ingest pipeline management) applies the attacker's index and ingest-pipeline configuration to existing infrastructure, redirecting the victim's data through the attacker's control. Attack requires network access and Fleet-level privileges; data interception persists even after package removal and requires separate infrastructure remediation.

## Affected products

- Elastic Kibana 8.14.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3

## References

- [https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860)

## Related threats

- [Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe)
- [Elastic Kibana credential disclosure in Observability onboarding](https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in)
- [Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana incorrect authorization in Fleet settings](https://junglewise.ai/threats/cve-2026-102412-incorrect-authorization-cwe-863-in-kibana-can-lead-to-sensitive)