CVE-2026-49095 Elastic CVE debrief

Who should care

Organizations running Kibana with Fleet enabled for centralized Elastic Agent management, particularly those with multiple administrators or delegated Fleet management responsibilities. Security teams monitoring for privilege escalation paths in Elastic Stack deployments and compliance officers tracking access controls for sensitive security data stores.

Technical summary

The vulnerability exists in Kibana's Fleet feature, which manages Elastic Agent deployments. The agent policy configuration mechanism accepts override values without adequate validation, allowing an authenticated Fleet administrator to inject malicious configuration parameters. When processed, these overrides cause the Fleet Server to generate API keys for Elastic Agents with elevated privileges beyond the standard Fleet management scope. Specifically, attackers can gain unauthorized read and write access to sensitive Elasticsearch security indices (such as .security* indices) that should be inaccessible to Fleet-managed agents. The attack requires valid credentials with Fleet management privileges but does not require user interaction, making it exploitable via API calls or automated tooling once authenticated access is obtained.

Defensive priority

medium

Recommended defensive actions

• Upgrade Kibana to patched versions 8.19.16, 9.3.5, or 9.4.2 or later per Elastic security advisory ESA-2026-38
• Audit Fleet agent policies for unauthorized configuration overrides, particularly those modifying API key privileges or Elasticsearch index access patterns
• Review Elastic Agent API key permissions in Elasticsearch to identify any with excessive privileges granted through Fleet policy manipulation
• Restrict Fleet management role assignments to only trusted administrative users with need for agent policy configuration access
• Monitor Elasticsearch audit logs for anomalous access patterns to security indices from Elastic Agent service accounts
• Validate agent policy configurations through code review or automated scanning before deployment to production environments

Evidence notes

CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. The vulnerability requires high privileges (PR:H) but is network-exploitable with low attack complexity. No known exploitation in the wild as of CVE publication date.

Official resources