UpHeron
All vulnerabilities

Servers and applications

CVE-2026-102412

Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an…

Severity
Medium 6.5
Published
6 Oct 2026
Last changed
9 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.4.8, 9.5.5
Sources
NVD

Affected software

SoftwareAffected versions
KibanaServers and applications · cpe:a:elastic:kibana
  • From 9.3.0 up to 9.3.8
  • From 9.4.0 before 9.4.8
  • From 9.5.0 before 9.5.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-102412
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-102412