Elastic published 14 security advisories covering Elasticsearch, Kibana, and Elastic Agent/Endpoint, including a high-severity Kibana flaw that lets delegated Fleet users intercept data from other users or teams.
Tracked as CVE-2026-102406, the Kibana flaw carries a CVSS score of 8.8. It affects Fleet’s package installation process, which failed to verify ownership before applying uploaded integration settings to an existing data stream.
An attacker with permission to install custom Fleet packages could claim a data stream identifier already used by another tenant, without needing direct Elasticsearch administrative privileges.
Fleet could then apply the attacker’s index and ingest-pipeline settings to existing infrastructure. This allowed newly ingested information to pass through infrastructure controlled by the attacker, exposing it to unauthorized access and modification while stopping delivery to its intended destination.
Elastic warned that interception could continue after removal of the malicious package. Administrators must therefore examine and separately repair affected infrastructure rather than treating package removal as complete remediation.
Elastic Fixes 14 Security Flaws
Here, “tenant” means users or teams within one Kibana deployment, not separate Elastic Cloud customers. The issue affects Kibana versions 8.14.0 through 8.19.21, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.3.
Fixes arrived in 8.19.22, 9.4.7, and 9.5.4. Both self-managed and Elastic Cloud Hosted installations are affected when delegated users can upload custom integration packages. Another high-severity flaw, CVE-2026-103009, scores 7.1 and affects cross-cluster search using Remote Cluster Security 2.0.
A specially crafted request can pass authorization against an allowed index while accessing a different, unauthorized index, exposing documents, mappings, and metadata. It requires access through the remote cluster transport interface and cannot be exploited through the REST API.
Elasticsearch also received fixes for denial-of-service weaknesses. CVE-2026-103008 allows an authenticated user with index read access to trigger excessive recursion through scripted geometry, terminating a node.
CVE-2026-102404 permits crafted ES|QL queries to exhaust memory and repeatedly disrupt cluster availability. Both carry CVSS scores of 6.5 and are fixed in 8.19.23, 9.4.8, and 9.5.5.
Elastic Endpoint’s CVE-2026-102413, rated 6.2, can cause repeated crashes when processing crafted filenames under certain Windows locales, including Chinese, Japanese, and Korean. These crashes can weaken or turn off malware prevention and behavioral detection.
Administrators should install the applicable fixed releases and review upgrade notes. Until Kibana is patched, Elastic recommends restricting custom package uploads to full superusers.
Investigators should review uploaded Fleet packages for reused datasets and unexpected changes to existing ingest pipelines. Elastic remediated the Kibana flaw in Cloud Serverless before disclosure.
Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC
