CVE-2026-4498

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Execution with unnecessary privileges in the debug route handlers of the Fleet plugin allows an authenticated user to read index data beyond their direct Elasticsearch RBAC (Role-Based Access Control) scope. This issue occurs when a user possesses Fleet sub-feature privileges, such as those for agents, agent policies, and settings management, enabling them to abuse these privileges to access unauthorized data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.