Elk: Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys (CVE-2026-72631)

The vulnerability in Kibana Fleet arises from improper privilege management where integration policies can declare extra data streams that the integration writes to. Fleet then adds these streams to the Elasticsearch API keys issued to Elastic Agents enrolled in the corresponding agent policy. This results in API keys that are over-scoped, allowing insertion of new documents and extension of index mappings on certain indices, but not allowing read, update, or delete operations. This can lead to privilege escalation within the system. The issue affects Kibana versions >=9.1.0 <9.4.5 and >=9.5.0 <9.5.1. A patch is available to fix this vulnerability.

The vulnerability allows Elastic Agent API keys to have more privileges than intended, specifically the ability to insert new documents and extend index mappings on certain indices. This could lead to privilege escalation within the environment where Kibana Fleet is used. However, the keys do not allow reading, updating, or deleting existing documents, limiting the scope of potential damage.

A patch is available for this vulnerability. Users should apply the official fix by upgrading to Kibana versions 9.4.5 or later and 9.5.1 or later as appropriate. No additional mitigation steps are indicated by the vendor advisory.