Executive brief
Kibana Fleet is a component used to manage and monitor Elastic Agents across distributed infrastructure. A vulnerability in the agent listing capability allows attackers to reconstruct encrypted API keys one character at a time by analyzing search result counts, potentially compromising authentication credentials for Elasticsearch. This information disclosure could lead to unauthorized access to logging and monitoring data.
Technical details
The vulnerability is an observable discrepancy (CWE-203) in Kibana Fleet's agent listing capability. Although the capability removes API key values from response payloads, it accepts caller-supplied filter expressions evaluated against stored API key fields using Kibana's internal Elasticsearch privileges rather than the caller's permissions. By crafting sequential filter expressions and observing whether the result count changes, an authenticated attacker can infer matching characters of an API key value, enabling side-channel reconstruction of the full credential. The vulnerability affects Kibana versions 8.19.0–8.19.19, 9.0.0–9.4.4, and 9.5.0. Patches are available in versions 8.19.20, 9.4.5, and 9.5.1, which prevent filter expressions from being applied to API key fields.
Affected products
- Elastic Kibana 8.19.0–8.19.19, 9.0.0–9.4.4, 9.5.0
Timeline
- 2026-08-13: disclosed: Security advisory ESA-2026-129 published
- 2026-08-13: patched: Fixed in Kibana 8.19.20, 9.4.5, 9.5.1