Improper Privilege Management in Kibana Fleet by Elastic

CVE-2026-72631

What is CVE-2026-72631?

A serious issue exists in Kibana Fleet, where improper privilege management can lead to privilege escalation. This vulnerability arises from the integration policy that allows for the declaration of additional data streams. When these data streams are written to, Fleet integrates them into the Elasticsearch API key provided to Elastic Agents under the agent policy. While the resulting key facilitates the insertion of new documents and expansion of index mappings for certain indices, it unfortunately does not restrict access adequately, potentially leading to unauthorized privileges for users.

References