CVE-2026-72631

Kibana Fleet vulnerability CVE-2026-72631: Improper Privilege Management can allow an Elastic Agent API key issued to agents in a policy to gain additional write rights (insert new documents and extend index mappings) for certain indices by including extra data streams in the integration policy. ...

PT-2026-35291

Summary The GET, POST, and DELETE handlers under /agents/:id/keys in the Paperclip control-plane API only call assertBoardreq, which verifies that the caller has a board-type session but does not verify that the caller has access to the company owning the target agent. A board user whose membersh...