Quick answers
- Is CVE-2026-102410 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102410 being exploited in the wild.
- How severe is CVE-2026-102410?
- Medium severity, with a CVSS score of 4.3, published 6 October 2026.
- Which products and versions are affected?
- Elastic Kibana 9.2.0 through 9.3.8.
- Is there a fix for CVE-2026-102410?
- Yes: fixed in Kibana 9.4.0. Until then: No workarounds are available; users unable to upgrade immediately should restrict data-store-level read access to sensitive indices and review access logs for unauthorized metric data retrieval. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-102410 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-102410?
- Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Kibana 9.4.0
No workarounds are available; users unable to upgrade immediately should restrict data-store-level read access to sensitive indices and review access logs for unauthorized metric data retrieval.
Technical details
An internal API in the Metrics Experience feature failed to enforce the same Kibana-level authorization checks as its related public API, allowing a user with data-store read access but no Kibana feature privilege to bypass authorization and retrieve index-derived metrics. The attack requires an authenticated user with underlying data access but no Kibana-level authorization. The vulnerability is fixed by upgrading to Kibana 9.4.0 or later, where the affected functionality was removed.
Affected products
- Elastic Kibana 9.2.0 through 9.3.8
Timeline
- 2026-10-06: disclosed