Information Disclosure Vulnerability in Kibana Fleet

CVE-2026-72632

What is CVE-2026-72632?

The vulnerability in Kibana Fleet arises due to an observable discrepancy where the system inadvertently provides access to the Elasticsearch API key via crafted filter expressions. When a caller requests the list of enrolled Elastic Agents, the filters are evaluated using Kibana’s internal privileges. This design flaw creates a side channel that allows an attacker to reconstruct sensitive API key values character by character through a series of requests, posing a significant risk of unauthorized information disclosure.

References