Executive brief
Kibana Fleet, the component that manages agent enrollment and policies in the Elastic Stack, improperly grants excessive permissions to API keys issued to Elastic Agents. An attacker with low privileges can exploit this to insert unauthorized documents into Elasticsearch indices and modify index mappings, potentially leading to data manipulation or disruption of search and indexing operations.
Technical details
The vulnerability is an Improper Privilege Management (CWE-269) issue in Kibana Fleet's API key generation. When an integration policy declares extra data streams, Fleet generates Elasticsearch API keys with overly broad permissions that allow agents to not only insert documents but also extend index mappings. While the key correctly restricts read, update, and delete operations, the ability to insert documents and modify mappings can be leveraged for privilege escalation. The vulnerability requires authentication (PR:L) and is network-reachable (AV:N), affecting all versions 9.1.0 through 9.4.4 and 9.5.0. Patches are available in versions 9.4.5 and 9.5.1.
Affected products
- Elastic Kibana 9.1.0 through 9.4.4 and 9.5.0
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in versions 9.4.5 and 9.5.1