Vulnerability Details CVE-2026-102410
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 9.7%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-102410
-
cpe:2.3:a:elastic:kibana:9.2.0
-
cpe:2.3:a:elastic:kibana:9.2.1
-
cpe:2.3:a:elastic:kibana:9.2.2
-
cpe:2.3:a:elastic:kibana:9.2.3
-
cpe:2.3:a:elastic:kibana:9.2.4
-
cpe:2.3:a:elastic:kibana:9.2.5
-
cpe:2.3:a:elastic:kibana:9.2.6
-
cpe:2.3:a:elastic:kibana:9.2.7
-
cpe:2.3:a:elastic:kibana:9.2.8
-
cpe:2.3:a:elastic:kibana:9.3.0
-
cpe:2.3:a:elastic:kibana:9.3.2
-
cpe:2.3:a:elastic:kibana:9.3.3
-
cpe:2.3:a:elastic:kibana:9.3.4
-
cpe:2.3:a:elastic:kibana:9.3.5
-
cpe:2.3:a:elastic:kibana:9.3.6
-
cpe:2.3:a:elastic:kibana:9.3.7
-
cpe:2.3:a:elastic:kibana:9.3.8