CVE-2026-4498

CVSS Score & Metrics

Base Score

7.7 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N                                    

Vulnerability Description

Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).

Vulnerability Details

Published Date

April 08, 2026

Last Modified

April 13, 2026

CWE ID

CWE-250

Source

NVD

Vendor

elastic

Product

kibana

External References

https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment