CVE-2026-4498: Privilege Abuse in Kibana Fleet Plugin

This vulnerability allows an attacker with sufficient privileges within Kibana to bypass Elasticsearch's Role-Based Access Control (RBAC) and access data they should not be authorized to view. The attacker needs to be an authenticated Kibana user with Fleet privileges, such as those managing agents, agent policies, or settings. Successful exploitation could lead to unauthorized access to sensitive data stored within Elasticsearch indices, potentially including personally identifiable information (PII), financial records, or other confidential data. The blast radius depends on the scope of the Elasticsearch indices accessible by the privileged Kibana user; a user with broad Fleet privileges could potentially access a significant portion of the Elasticsearch cluster's data.

1. Reserved2026-03-20
2. Published2026-04-08
3. Modified2026-04-09
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-4498 is to upgrade Kibana to version 8.19.14 or later. If upgrading immediately is not feasible, consider restricting Fleet privileges to the minimum necessary for users. Review and tighten Elasticsearch RBAC configurations to ensure that users only have access to the data they require. Implement monitoring and alerting to detect unusual access patterns or attempts to access data outside of expected RBAC boundaries. While a WAF is unlikely to directly mitigate this, it can help detect and block suspicious requests targeting the Fleet plugin's debug routes.