Description

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T19:17:28.850Z",
  "pubdate": "2026-09-03T19:17:28.850Z",
  "executiveSummary": "This vulnerability involves a missing authorization flaw (CWE-862) within the Kibana Fleet feature, allowing for unauthorized cross-space information disclosure.\nThe issue permits an authenticated user with restricted read-level access to Fleet agent privileges in a specific Kibana space to circumvent multi-tenancy isolation.\nBy leveraging this flaw, an attacker can perform Privilege Abuse (CAPEC-122) to enumerate sensitive agent metadata and extract diagnostic content from agents assigned to unrelated Kibana spaces.\nThe primary risk entails the exposure of internal system configurations, operational telemetry, and potentially sensitive environment metadata that should be partitioned by space-level access controls.\nExploitation requires the attacker to possess a legitimate account with read-level Fleet privileges; however, no administrative access is required to perform the unauthorized enumeration of cross-space resources.\nThe vulnerability highlights a failure in the Kibana backend to enforce strict authorization boundaries when processing Fleet agent metadata requests across different tenants.",
  "technicalDetails": "The vulnerability resides in the Kibana Fleet feature's handling of authorization checks during API requests related to agent management and monitoring.\nRoot Cause: The underlying authorization logic fails to validate whether the requester possesses the required permissions within the specific context of the target space. While the system correctly identifies the user's role within their home space, it lacks a restrictive check to verify scope-level ownership or cross-space access boundaries when querying for agent information.\nAttack Flow: An attacker authenticated with read-level Fleet privileges initiates a targeted API call directed at the Kibana Fleet metadata endpoints. By manipulating the request parameters or targeting specific Fleet agent IDs associated with foreign spaces, the attacker forces the system to return serialized diagnostic data and configuration details.\nPrivilege Abuse (CAPEC-122): The attacker utilizes their existing, legitimate access rights as a vehicle to query unauthorized data containers. Because the system assumes the user's scope is implicit or not strictly enforced against global Fleet objects, the request is processed and returned with elevated visibility into foreign metadata.\nPayload Behavior: The payload involves legitimate GET requests to Fleet-related endpoints. The response includes comprehensive diagnostic content, which may contain sensitive environmental data, agent status, and host-level metadata that were intended to be restricted to administrators or users specifically authorized for those spaces.\nTechnical Impact: The successful exploitation facilitates unauthorized information disclosure, enabling an attacker to map out infrastructure across multiple Kibana spaces. This metadata provides reconnaissance data that can be used to identify internal system architecture, security configurations, or potentially vulnerable agent versions in segregated environments.\nAuthentication/Privilege Requirements: The vulnerability is exploitable by any authenticated user who has been assigned the minimum read-level privileges necessary to view Fleet agents within their own authorized space. No specialized exploit code is required, as the vulnerability is triggered by the inherent failure of the application's access control middleware to properly isolate resource queries."
}