CVE-2026-102406: CWE-639 Authorization Bypass Through User-Controlled Key in Elastic Kibana

This vulnerability (CWE-639) in Kibana's Fleet package installation process permits a user with delegated Fleet package-management privileges, but without Elasticsearch administrative rights, to claim an existing data stream identifier belonging to another tenant. Because Kibana does not verify ownership of the identifier before applying the package's index and ingest-pipeline settings, an attacker can redirect the victim tenant's data stream through infrastructure under their control. This leads to unauthorized disclosure and modification of the victim's ingested data and prevents it from reaching its intended destination. The interception can continue even after the malicious package is removed, necessitating separate infrastructure remediation.

An attacker with delegated Fleet package-management privileges can intercept, modify, and disrupt data streams of other tenants sharing the same Kibana deployment. This results in unauthorized data disclosure, data integrity compromise, and denial of data delivery to the intended destination. The persistence of the interception beyond package removal increases the impact by requiring additional remediation steps.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict delegated Fleet package-management privileges to trusted users only and monitor for unauthorized package installations. After any suspected exploitation, perform thorough remediation of the affected infrastructure to remove any persistent interception.