Elk: Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys (CVE-2026-72632)

CVE-2026-72632 is an observable discrepancy vulnerability in Kibana Fleet that leads to information disclosure of Elastic Agent Elasticsearch API keys. The agent listing API removes API key values from responses but accepts filter expressions over the stored API key field. These filters are evaluated with Kibana's internal Elasticsearch privileges rather than the caller's, allowing an attacker to use the count of matching agents as a side channel. This side channel enables reconstruction of the full API key value character by character through a sequence of requests.

An attacker with access to the Fleet agent listing API can extract full Elasticsearch API keys of enrolled Elastic Agents. This disclosure could lead to unauthorized access to Elasticsearch resources using those API keys, potentially compromising data confidentiality and integrity within the affected environment.

A patch is available for this vulnerability. Users should upgrade Kibana to a fixed version to eliminate this side-channel information disclosure. The affected versions are >=8.19.0 <8.19.20, >=9.0.0 <9.4.5, and >=9.5.0 <9.5.1. No additional mitigations are indicated beyond applying the official fix.