CVE-2026-72632

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An observable discrepancy in Kibana Fleet allows for information disclosure through excavation. While Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from agent listing responses, the capability accepts caller-supplied filter expressions over the stored field containing the value. These expressions are evaluated using Kibana's internal Elasticsearch privileges instead of the caller's. Since the system reports the number of matching agents, a side channel is created, allowing the full API key value to be reconstructed one character at a time through a sequence of requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.