Elk: Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure (CVE-2026-78595)

This vulnerability involves missing authorization in the Kibana Fleet feature, allowing an authenticated user with read-level privileges in one Kibana space to access metadata and diagnostic information of Fleet agents in other Kibana spaces. The flaw is categorized as CWE-862 (Missing Authorization) and can result in information disclosure through privilege abuse (CAPEC-122). The CVSS 3.1 base score is 4.3, indicating a medium impact primarily on confidentiality. There is no indication of integrity or availability impact. No known exploits are reported, and no patch or vendor advisory information is available at this time.

An attacker with authenticated read-level Fleet agent privileges in one Kibana space can access sensitive metadata and diagnostic content from agents in other spaces, leading to unauthorized information disclosure. This could expose operational details or other sensitive data related to Fleet agents across different spaces within Kibana.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Fleet agent read privileges to trusted users only and monitor access controls to minimize exposure.