CVE-2026-4498 | BDVDB-2026-325544 Detail

Description#

Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-08Record published in the CVE List.
2. Version 22026-04-09Most recent update recorded in the CVE List.