Security Advisory

CVE-2026-4498

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-08 16:38:59

Last updated 2026-04-09 14:27:38

Assigner elastic

CVSS score 7.7

State PUBLISHED

Description

Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).

← Browse all CVEs View on cve.org ↗