# CVE-2026-102412: Elastic Kibana incorrect authorization in Fleet settings

Source: https://junglewise.ai/threats/cve-2026-102412-incorrect-authorization-cwe-863-in-kibana-can-lead-to-sensitive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-102412 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Kibana, Elastic's data visualization and exploration platform, contains an authorization flaw that allows authenticated users with limited Fleet management access to view sensitive cryptographic credentials they should not be able to access. An attacker with basic Fleet privileges could obtain private SSL keys used to secure Fleet Server connections, potentially allowing them to impersonate Fleet infrastructure components and intercept communications in deployments using these keys.

Technologies: [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-102412 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102412 being exploited in the wild.

**How severe is CVE-2026-102412?** Medium severity, with a CVSS score of 6.5, published 6 October 2026.

**Which products and versions are affected?** Elastic Kibana 9.3.0 to 9.3.8, 9.4.0 to 9.4.7, 9.5.0 to 9.5.4.

**Is there a fix for CVE-2026-102412?** Yes: fixed in Kibana 9.4.8, 9.5.5. Until then: Administrators can remove the Fleet agent management feature privilege from Kibana roles assigned to users who should not access Fleet Server host configuration. Users requiring Fleet agent operations but not Fleet settings visibility should not be granted the agents_all privilege unless they also hold Fleet settings read access. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102412 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-102412?** Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Kibana 9.4.8, 9.5.5

Administrators can remove the Fleet agent management feature privilege from Kibana roles assigned to users who should not access Fleet Server host configuration. Users requiring Fleet agent operations but not Fleet settings visibility should not be granted the agents_all privilege unless they also hold Fleet settings read access.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in Kibana's Fleet functionality where role-based access controls (ACLs) do not properly restrict access to Fleet Server host SSL/TLS private key material. An authenticated user with limited Fleet agent management privileges can access sensitive credential data that should only be visible to administrators with Fleet settings permissions. Exploitation requires authentication and the presence of Fleet Server hosts configured with SSL/TLS private keys in Fleet settings, potentially enabling infrastructure impersonation.

## Affected products

- Elastic Kibana 9.3.0 to 9.3.8, 9.4.0 to 9.4.7, 9.5.0 to 9.5.4

## Timeline

- 2026-10-06: disclosed
- 2026-10-06: patched: Fixes released in Kibana 9.4.8 and 9.5.5

## References

- [https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866](https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866)

## Related threats

- [Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe)
- [Elastic Kibana credential disclosure in Observability onboarding](https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in)
- [Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana missing authorization in Metrics Experience](https://junglewise.ai/threats/cve-2026-102410-missing-authorization-cwe-862-in-kibana-can-lead-to-information)