Authorization Bypass in Kibana Affects Multiple Tenants

CVE-2026-102406

What is CVE-2026-102406?

A flaw in Kibana's Fleet package installation process allows a user with delegated package-management rights to claim a data stream identifier from another tenant. Since the ownership verification of the identifier is insufficient, this can lead to unauthorized access to a tenant's data. An attacker can manipulate data streams to redirect sensitive information under their control, exposing it to unauthorized visibility and modification. Even after the malicious package is removed, the risk of data interception persists, necessitating comprehensive remediation of the compromised infrastructure.

References