This vulnerability arises from improper input validation (CWE-20) in Kibana's Fleet agent policy management. An authenticated user with Fleet management privileges can inject malicious values into a configuration override mechanism that lacks adequate validation controls. Exploiting this flaw allows the attacker to escalate privileges by causing Elastic Agents to be issued API keys with higher Elasticsearch privileges than intended. This can lead to unauthorized access, including read and write operations on sensitive Elasticsearch security indices, exceeding the permissions normally granted to the Fleet management role. The CVSS 3.1 base score is 7.2, reflecting a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high confidentiality and integrity impact.

Successful exploitation can lead to privilege escalation within the Elastic Stack environment. Specifically, attackers can gain unauthorized read and write access to sensitive Elasticsearch security indices by manipulating agent policy configurations. This compromises the confidentiality and integrity of critical security data managed by Elasticsearch. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, organizations should restrict Fleet management privileges to trusted administrators only and monitor for unusual policy changes. Avoid granting Fleet management privileges broadly until a patch or official mitigation is available.