CVE-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Attackers with Fleet privileges can hijack data streams to intercept and modify other tenants' data in Kibana deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102406?
CVE-2026-102406 is a high-severity missing authorization vulnerability in Elastic Kibana, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.
Weakness: CWE-639
Which versions are affected by CVE-2026-102406?
2 open source packages ship an affected version, including kibana and elk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | From 8.14.0 | 8.19.22, 9.4.7, 9.5.4 |
elk Bitnami | From 8.14.0 | 8.19.22, 9.4.7, 9.5.4 |
Products include Elastic Kibana.
How do I fix CVE-2026-102406?
Upgrade kibana to a fixed version for your release line: 8.19.22, 9.4.7 or 9.5.4.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-102406 being exploited?
There is no known exploitation of CVE-2026-102406 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as BIT-elk-2026-102406, BIT-kibana-2026-102406, GHSA-gpr2-2mpc-hvf2, MINI-6cwj-pxx8-j4vw, MINI-7724-q964-7ff2, MINI-79g2-vf5w-j7g9 and 5 more.