CVE-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Authenticated users with limited privileges can access sensitive cryptographic keys, enabling potential impersonation of Fleet infrastructure components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-102412?
CVE-2026-102412 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used.
Weakness: CWE-863
Which versions are affected by CVE-2026-102412?
2 open source packages ship an affected version, including kibana and elk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | From 9.3.0 | 9.4.8, 9.5.5 |
elk Bitnami | From 9.3.0 | 9.4.8, 9.5.5 |
Products include Elastic Kibana.
How do I fix CVE-2026-102412?
Upgrade kibana to a fixed version for your release line: 9.4.8 or 9.5.5.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-102412 being exploited?
There is no known exploitation of CVE-2026-102412 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as BIT-elk-2026-102412, BIT-kibana-2026-102412, GHSA-xpvr-j3f7-hgw4, MINI-3925-2277-9q56, MINI-8rf3-vvf9-jxpw, MINI-mgfh-gq59-2w6m.