This vulnerability (CVE-2026-72631) in Elastic Kibana Fleet involves improper privilege management (CWE-269) where integration policies can declare additional data streams that are included in the Elasticsearch API key granted to Elastic Agents. The API key permits inserting new documents and extending index mappings on specific indices but restricts reading, updating, or deleting existing documents. This can lead to privilege escalation (CAPEC-233) by allowing agents to perform unauthorized data insertions and schema changes. The vulnerability affects Kibana versions 9.1.0 and 9.5.0. No official patch or remediation level has been provided yet, and there are no known exploits in the wild.

The vulnerability allows privilege escalation by granting Elastic Agents API keys that permit insertion of new documents and extension of index mappings on certain indices. This could impact data integrity by allowing unauthorized data insertion and schema modification. However, the API key does not allow reading, updating, or deleting existing documents, limiting the scope of potential damage. The CVSS score of 6.5 reflects a medium severity impact primarily on data integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Elastic's advisories for updates. Until a fix is available, carefully review and restrict integration policies that declare extra data streams to minimize exposure. Avoid granting overly broad privileges in API keys issued to Elastic Agents.