CVE-2026-49095 Improper Input Validation in Kibana Fleet Leading to Privilege Escalation

What is CVE-2026-49095?

CVE-2026-49095 is a high-severity vulnerability in Elastic Kibana, published on 28 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role.

Weakness: CWE-20

Which versions are affected by CVE-2026-49095?

2 open source packages ship an affected version, including kibana and elk. It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2026-49095?

Upgrade kibana to a fixed version for your release line: 8.19.16, 9.3.5 or 9.4.2.

Is CVE-2026-49095 being exploited?

There is no known exploitation of CVE-2026-49095 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-elk-2026-49095, BIT-kibana-2026-49095, GHSA-p9vc-h7rw-q6hq, MINI-39fw-749w-xrfv, MINI-69c3-wr27-jjq9, MINI-69x3-w9cj-f2xp and 4 more.