CVE-2026-102406

A CWE-639 Authorization Bypass in Kibana allows users with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant. Because ownership is not verified before Fleet applies settings from an uploaded package, an attacker can redirect another t...