BIT-KIBANA-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

CVE-2026-78595

CVE-2026-78595 is a Missing Authorization (CWE-862) vulnerability in the Kibana Fleet feature that enables cross-space information disclosure. An authenticated user with only read-level Fleet agent privileges in one Kibana space can enumerate agent metadata and access diagnostic content belonging...

EUVD-2026-20528

Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...

CVE-2026-4498

CVE-2026-4498 concerns Kibana, specifically the Fleet plugin, where execution with unnecessary privileges arises from Kibana’s Fleet debug route handlers. An authenticated Kibana user with Fleet sub-feature privileges (e.g., agents, agent policies, settings management) can read index data beyond ...