Vulnerability-Lookup

CVE-2026-102406 (GCVE-0-2026-102406)

Vulnerability from cvelistv5 – Published: 2026-10-06 19:31 – Updated: 2026-10-06 19:56

Title

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Summary

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 19:56 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

elastic mitre root Scorecard

References

1 reference

URL	Tags
https://discuss.elastic.co/t/kibana-8-19-22-9-4-7…

Impacted products

1 product

Vendor	Product	Version	CPE status
Elastic	Kibana	Affected: 8.14.0 , ≤ 8.19.21 (semver) Affected: 9.0.0 , ≤ 9.4.6 (semver) Affected: 9.5.0 , ≤ 9.5.3 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102406",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:56:48.673010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T19:56:58.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kibana",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThanOrEqual": "8.19.21",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.4.6",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.5.3",
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.\u003c/p\u003e"
            }
          ],
          "value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T19:31:36.178Z",
        "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "shortName": "elastic"
      },
      "references": [
        {
          "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
        }
      ],
      "source": {
        "discovery": "Elastic"
      },
      "title": "Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception",
      "x_generator": {
        "engine": "Elastic CVE Publisher 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
    "assignerShortName": "elastic",
    "cveId": "CVE-2026-102406",
    "datePublished": "2026-10-06T19:31:36.178Z",
    "dateReserved": "2026-09-29T02:06:02.426Z",
    "dateUpdated": "2026-10-06T19:56:58.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-102406",
      "date": "2026-10-07",
      "epss": "0.00354",
      "percentile": "0.27022"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Kibana",
                "vendor": "Elastic",
                "versions": [
                  {
                    "lessThanOrEqual": "8.19.21",
                    "status": "affected",
                    "version": "8.14.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.4.6",
                    "status": "affected",
                    "version": "9.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.5.3",
                    "status": "affected",
                    "version": "9.5.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@elastic.co"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure."
          }
        ],
        "id": "CVE-2026-102406",
        "lastModified": "2026-10-07T13:42:52.070",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security@elastic.co",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-102406",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:56:48.673010Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T20:17:12.480",
        "references": [
          {
            "source": "security@elastic.co",
            "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
          }
        ],
        "sourceIdentifier": "security@elastic.co",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security@elastic.co",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-102406",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-06T19:56:48.673010Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T19:56:53.435Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Kibana",
              "vendor": "Elastic",
              "versions": [
                {
                  "lessThanOrEqual": "8.19.21",
                  "status": "affected",
                  "version": "8.14.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.4.6",
                  "status": "affected",
                  "version": "9.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.5.3",
                  "status": "affected",
                  "version": "9.5.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.\u003c/p\u003e"
                }
              ],
              "value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T19:31:36.178Z",
            "orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
            "shortName": "elastic"
          },
          "references": [
            {
              "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
            }
          ],
          "source": {
            "discovery": "Elastic"
          },
          "title": "Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception",
          "x_generator": {
            "engine": "Elastic CVE Publisher 1.0.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
        "assignerShortName": "elastic",
        "cveId": "CVE-2026-102406",
        "datePublished": "2026-10-06T19:31:36.178Z",
        "dateReserved": "2026-09-29T02:06:02.426Z",
        "dateUpdated": "2026-10-06T19:56:58.361Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1276

Vulnerability from certfr_avis - Published: 2026-10-07 - Updated: 2026-10-07

De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Elastic	Elasticsearch	Elasticsearch versions antérieures à 8.19.23
Elastic	Kibana	Kibana versions 9.5.x antérieures à 9.5.5
Elastic	Elastic Agent	Elastic Agent versions antérieures à 8.19.22
Elastic	Elasticsearch	Elasticsearch versions 9.x antérieures à 9.4.8
Elastic	Kibana	Kibana versions antérieures à 8.19.22
Elastic	Elastic Agent	Elastic Agent versions 9.x antérieures à 9.4.8
Elastic	Kibana	Kibana versions 9.x antérieures à 9.4.8
Elastic	Elastic Agent	Elastic Agent versions 9.5.x antérieures à 9.5.5
Elastic	Elasticsearch	Elasticsearch versions 9.5.x antérieures à 9.5.5

References

Title

Publication Time

Tags

Bulletin de sécurité Elastic 390866	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390872	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390862	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390871	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390869	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390863	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390861	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390859	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390864	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390870	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390860	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390868	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390874	2026-10-06	vendor-advisory
Bulletin de sécurité Elastic 390865	2026-10-06	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Elasticsearch versions ant\u00e9rieures \u00e0 8.19.23",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions ant\u00e9rieures \u00e0 8.19.22",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 9.x ant\u00e9rieures \u00e0 9.4.8",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions ant\u00e9rieures \u00e0 8.19.22",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 9.x ant\u00e9rieures \u00e0 9.4.8",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Kibana versions 9.x ant\u00e9rieures \u00e0 9.4.8",
      "product": {
        "name": "Kibana",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elastic Agent versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
      "product": {
        "name": "Elastic Agent",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    },
    {
      "description": "Elasticsearch versions 9.5.x ant\u00e9rieures \u00e0 9.5.5",
      "product": {
        "name": "Elasticsearch",
        "vendor": {
          "name": "Elastic",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-102406",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102406"
    },
    {
      "name": "CVE-2026-103006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103006"
    },
    {
      "name": "CVE-2026-102404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102404"
    },
    {
      "name": "CVE-2026-103009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103009"
    },
    {
      "name": "CVE-2026-102410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102410"
    },
    {
      "name": "CVE-2026-102409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102409"
    },
    {
      "name": "CVE-2026-102412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102412"
    },
    {
      "name": "CVE-2026-102408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102408"
    },
    {
      "name": "CVE-2026-103005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103005"
    },
    {
      "name": "CVE-2026-103008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103008"
    },
    {
      "name": "CVE-2026-102407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102407"
    },
    {
      "name": "CVE-2026-102413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102413"
    },
    {
      "name": "CVE-2026-103007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103007"
    },
    {
      "name": "CVE-2026-102411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102411"
    }
  ],
  "initial_release_date": "2026-10-07T00:00:00",
  "last_revision_date": "2026-10-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1276",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Elastic. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Elastic",
  "vendor_advisories": [
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390866",
      "url": "https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390872",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-198/390872"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390862",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390871",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390869",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390863",
      "url": "https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390861",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390859",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390864",
      "url": "https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390870",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-2-security-update-esa-2026-196/390870"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390860",
      "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390868",
      "url": "https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390874",
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874"
    },
    {
      "published_at": "2026-10-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Elastic 390865",
      "url": "https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865"
    }
  ]
}

FKIE_CVE-2026-102406

Vulnerability from fkie_nvd - Published: 2026-10-06 20:17 - Updated: 2026-10-07 13:42

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@elastic.co	https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Kibana",
          "vendor": "Elastic",
          "versions": [
            {
              "lessThanOrEqual": "8.19.21",
              "status": "affected",
              "version": "8.14.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.4.6",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.5.3",
              "status": "affected",
              "version": "9.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@elastic.co"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure."
    }
  ],
  "id": "CVE-2026-102406",
  "lastModified": "2026-10-07T13:42:52.070",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@elastic.co",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-102406",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-06T19:56:48.673010Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T20:17:12.480",
  "references": [
    {
      "source": "security@elastic.co",
      "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
    }
  ],
  "sourceIdentifier": "security@elastic.co",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security@elastic.co",
      "type": "Secondary"
    }
  ]
}

GHSA-GPR2-2MPC-HVF2

Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-06 21:31

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-102406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T20:17:12Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, \"tenant\" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana\u0027s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package\u0027s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant\u0027s data stream through infrastructure under their control. This exposed the affected tenant\u0027s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure.",
  "id": "GHSA-gpr2-2mpc-hvf2",
  "modified": "2026-10-06T21:31:54Z",
  "published": "2026-10-06T21:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102406"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-102406 (GCVE-0-2026-102406)

CERTFR-2026-AVI-1276

Solutions

FKIE_CVE-2026-102406

GHSA-GPR2-2MPC-HVF2

Tags

Sightings

Nomenclature

Related by attack behaviour