# CVE-2026-82302: Elastic Kibana authorization bypass in access control

Source: https://junglewise.ai/threats/cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82302 · Severity: high · CVSS 8.1 · Published 2026-09-03

Kibana, Elastic's log analysis and visualization platform, contains an authorization flaw that allows authenticated users to modify system configurations they should not have access to. This affects deployments with Fleet and agent policy management enabled. An attacker with valid credentials could alter critical cluster settings or policies, potentially compromising data integrity and operational security across the entire Elastic deployment.

Technologies: [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-82302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82302 being exploited in the wild.

**How severe is CVE-2026-82302?** High severity, with a CVSS score of 8.1, published 3 September 2026.

**Which products and versions are affected?** Elastic Kibana 8.0.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.2.

**Is there a fix for CVE-2026-82302?** A patch was published on 2026-09-03: Fixes available in Kibana 8.19.21, 9.4.6, and 9.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82302 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82302?** Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in Kibana's access control implementation, specifically in how it validates permissions for configuration modifications. The flaw results from incorrectly configured access control security levels (CAPEC-180), allowing users with limited privileges to bypass authorization checks and modify protected settings. The attack requires valid authentication credentials but no elevated privileges; once authenticated, an attacker can make unauthorized configuration changes via the Kibana API or UI. The vulnerability affects all configurations with Fleet and agent policy management enabled. Patches are available in Kibana 8.19.21, 9.4.6, and 9.5.3; no workarounds exist for unpatched systems.

## Affected products

- Elastic Kibana 8.0.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.2

## Timeline

- 2026-09-03: disclosed: Published via ESA-2026-178 and CVE-2026-82302
- 2026-09-03: patched: Fixes available in Kibana 8.19.21, 9.4.6, and 9.5.3

## References

- [https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-178/390164](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-178/390164)

## Related threats

- [Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe)
- [Elastic Kibana credential disclosure in Observability onboarding](https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in)
- [Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana incorrect authorization in Fleet settings](https://junglewise.ai/threats/cve-2026-102412-incorrect-authorization-cwe-863-in-kibana-can-lead-to-sensitive)