CVE Feed

    Dashboard / CVE / CVE-2026-102410

    CVE-2026-102410

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

    Published:Oct 6, 2026
    Last Modified:Oct 9, 2026
    EPS:Oct 6, 2026
    EPSS Score:0.00206
    CVSS Score:4.3

    Affected Products

    Vendor
    Elastic
    Product
    Kibana

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-115295 (CVSS 4.3) — Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Ac…
    CVE-2026-115294 (CVSS 7.3) — Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to u…
    CVE-2026-115293 (CVSS 6.5) — Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to dis…
    CVE-2026-115292 (CVSS 4.3) — Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information …
    CVE-2026-102412 (CVSS 6.5) — Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functio…
    CVE-2026-102406 (CVSS 8.8) — Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data intercept…
    CVE-2026-94400 (CVSS 6.5) — Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAP…
    CVE-2026-78582 (CVSS 6.5) — Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly…
    CVE-2026-72662 (CVSS 6.3) — Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modi…
    CVE-2026-72668 (CVSS 7.3) — Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High