Authorization Flaw in Kibana Metrics Experience by Elastic

CVE-2026-102410

What is CVE-2026-102410?

A vulnerability in Kibana's Metrics Experience feature arises from missing authorization checks, allowing users with limited data-store-level access to access sensitive index-derived metric data. This issue results from an internal API not enforcing proper ACLs, potentially exposing information that should be restricted to authorized users only. As a consequence, those without the necessary Kibana feature privileges can retrieve data that should be inaccessible, creating a notable security concern for organizations relying on Kibana's functionalities.

References