Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN978 _____________________________________________________________________ DATE : 07/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Kibana versions prior to 8.19.22, 9.4.8, 9.5.5. ==================================================================== https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860 https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864 https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866 _____________________________________________________________________ Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187) cronosda Piyal Biswas Elastic Team Member Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant's data stream through infrastructure under their control. This exposed the affected tenant's subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure. Affected Versions: 8.x: All versions from 8.14.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: Kibana deployments with Fleet enabled where a user without full superuser access has been granted the Fleet feature privileges required to install custom (uploaded) integration packages. Both self-managed and Elastic Cloud Hosted deployments are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.22, 9.4.7, and 9.5.4. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: Self-hosted Until upgrading, remove the Fleet feature privileges required to install custom integration packages from any role held by a user who should not be trusted to manage other tenants' data, restricting custom package uploads to full superusers only. Cloud The same privilege restriction can be applied on Elastic Cloud Hosted through Kibana role management; no additional cloud-specific limitation is required. Indicators of Compromise (IOC) Review the installation history of uploaded (non-registry) Fleet packages for any package that declares a dataset already used by a data stream you did not create, and check whether the ingest pipeline governing an existing data stream's backing indices changed as a result of a package installation you did not expect. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 8.8 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-102406 Problem Type: CWE-639 - Authorization Bypass Through User-Controlled Key _____________________________________________________________________ Kibana 9.4.0 Security Update (ESA-2026-191) cronosda Piyal Biswas Elastic Team Member Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked. Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.3.8 Users on the 8.x release line are not affected. The Metrics Experience functionality that contains this vulnerability was introduced in version 9.2.0 and is not present in earlier releases. Users on the 9.4.x and later release lines are not affected because the affected functionality was removed entirely from Kibana in version 9.4.0. Affected Configurations: All configurations running an affected version with the Metrics Experience feature present are affected. Exposure requires that a user already hold read access to a data index at the underlying data-store layer, independent of their Kibana feature privileges. Solutions and Mitigations: This vulnerability is resolved by upgrading to version 9.4.0 or later, in which the affected Metrics Experience functionality was removed entirely. There is no patched release within the 9.2.x or 9.3.x lines; those lines are no longer receiving new releases, so affected customers must upgrade to a currently maintained release line. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE ID: CVE-2026-102410 Problem Type: CWE-862 - Missing Authorization _____________________________________________________________________ Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193) cronosda Piyal Biswas Elastic Team Member Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used. Affected Versions: 9.x: All versions from 9.3.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 No fix is available for the 9.3.x line, which is no longer maintained. Users on 9.3.x should upgrade to a supported release line. Users on the 8.x release line are not affected. The Fleet Server host SSL private key functionality that contains this vulnerability was introduced after the 8.x release line and is not present in 8.19.x. Affected Configurations: Kibana deployments using Fleet where Fleet Server hosts are configured with SSL/TLS private key material stored in Fleet settings. Deployments that do not configure Fleet Server hosts with private key material in Fleet settings are not exposed to this vulnerability. Solutions and Mitigations: The issue is resolved in Kibana 9.4.8 and 9.5.5. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: Self-hosted and Cloud: Administrators can mitigate this vulnerability by removing the Fleet agent management feature privilege from any Kibana role assigned to users who should not have access to Fleet Server host configuration data. Users who require Fleet agent operations but not Fleet settings visibility should not be granted the Fleet agents_all Kibana feature privilege unless they also hold Fleet settings read access. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE ID: CVE-2026-102412 Problem Type: CWE-863 - Incorrect Authorization Impact: CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================