CVE-2026-72631

Name of the Vulnerable Software and Affected Versions Kibana Fleet (affected versions not specified)

Description Improper privilege management in Kibana Fleet allows for privilege escalation. This occurs when an integration policy declares extra data streams for writing, which Fleet then adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. Consequently, the resulting key permits the insertion of new documents and the extension of index mappings for specific indices, although it does not allow reading, updating, or deleting existing documents.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.