This vulnerability allows a lower privileged user who only has permission to read agent policies to bypass intended access controls and read the entire Fleet proxy configuration in Elastic Kibana. Normally, reading these settings requires the Fleet privilege. The exposed proxy configuration can contain sensitive information such as proxy authentication credentials and private keys, leading to an unauthorized disclosure of sensitive data. The CVSS 3.1 score is 7.7 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality without affecting integrity or availability.

Unauthorized disclosure of sensitive information including proxy authentication credentials and private key material. This could lead to further compromise if the exposed credentials are used maliciously. There is no indication of impact on system integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a fix is available, restrict access to users who require the Fleet privilege and monitor for unauthorized access attempts to sensitive proxy configurations.