CVE-2026-102406

Executive Summary

CVE-2026-102406 is an authorization bypass vulnerability (CWE-639) in Kibana's Fleet package installation process. A user holding delegated Fleet package-management privileges can claim a data stream identifier that is already owned by another tenant and redirect that tenant's subsequently ingested data to infrastructure under the attacker's control. The flaw enables cross-tenant data interception, disclosure, and modification within a shared Kibana deployment, and the interception can persist even after the malicious package is removed, requiring separate remediation of the affected infrastructure.

Technical Analysis

CVE-2026-102406 resides in the Kibana Fleet package installation process. The vulnerability class is Authorization Bypass Through User-Controlled Key (CWE-639), which occurs when an application uses a user-supplied identifier to access a resource without verifying that the requesting principal is authorized to own, control, or act on that resource. The NVD description confirms that Kibana's Fleet package installation flow did not verify ownership of a data stream identifier before applying the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure.

Three elements are required for exploitation, all confirmed in the description: (1) the attacker must hold delegated Fleet package-management privileges, (2) the attacker must not hold direct Elasticsearch administrative privileges, and (3) the attacker must know or guess a data stream identifier already in use by a target tenant. Because ownership verification was absent, the attacker can supply a package whose generated configuration targets the victim tenant's existing data stream identifier. When Fleet applies those settings, the data stream is bound to attacker-supplied infrastructure configuration.

The term "tenant" in this advisory refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. This is significant: it means the isolation boundary is logical rather than organizational, and the delegated privilege model is the primary control that was bypassed. The vulnerability result is twofold — the victim's data is routed to a destination controlled by the attacker (interception/disclosure), and it ceases to reach its legitimate destination (integrity/availability of downstream ingestion).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8. The network attack vector and low attack complexity indicate remote exploitation with no special conditions, and no user interaction is required. The PR:L privilege requirement reflects the need for delegated Fleet package-management rights, which limits the attacker population but does not eliminate the risk in environments where such delegation is common. Confidentiality and Integrity impacts are both High, which aligns with data interception plus modification. Scope is Unchanged, meaning the impact is contained within the same security authority as defined by CVSS — consistent with the advisory's clarification that the affected boundary is a tenant within one Kibana deployment, not a separate cloud organization.

No proof-of-concept, exploit code, or Nuclei template is publicly available, and the vulnerability is not listed in CISA KEV. No OSV packages or affected version ranges were supplied. The technical mechanism is therefore described strictly at the vulnerability-class level: a user-controlled identifier in the Fleet package installation flow is trusted without an ownership check, allowing one tenant to bind another tenant's data stream to attacker-controlled index and ingest-pipeline infrastructure.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the NVD description, using only the components explicitly named in the advisory.

1. Reconnaissance / target identification. The attacker, operating with delegated Fleet package-management privileges inside a shared Kibana deployment, identifies a data stream identifier already in use by another tenant. The advisory confirms that "claiming a data stream identifier already in use by another tenant" is the operative step, which implies the identifier is discoverable or guessable within the deployment.

2. Triggering the flaw class. The attacker uploads a package whose generated index and ingest-pipeline settings reference the victim tenant's data stream identifier. In a correctly implemented authorization flow, Fleet would first verify that the requesting principal owns or is authorized to modify that identifier. In the vulnerable flow, per the NVD description, "ownership of that identifier was not verified before Fleet applied the uploaded package's generated index and ingest-pipeline settings to already-existing infrastructure." The authorization check is therefore bypassed by supplying a key (the identifier) that belongs to another principal.

3. Payload / execution method. The package installation process itself is the execution vector — no memory corruption, no injection payload, and no hypothetical function names are required to describe it. The attacker's influence is the package they are permitted to upload and install using their delegated Fleet privileges. The "payload" is the package metadata that reroutes an existing data stream.

4. Post-exploitation impact. With the index and ingest-pipeline settings applied to the victim's existing data stream, the victim tenant's subsequently ingested data flows through infrastructure under the attacker's control. The advisory states this exposes that data to "unauthorized disclosure and modification" and "prevented that data from reaching its intended destination." Critically, the interception can continue after the malicious package is removed, which means the attacker maintains persistence through the modified infrastructure configuration and requires the defender to perform separate remediation on the affected infrastructure rather than relying on package removal alone.

Impact Assessment

The business impact centers on loss of tenant isolation within a shared Kibana deployment. Any organization that grants delegated Fleet package-management privileges to users or teams who are not trusted with Elasticsearch administrative rights should treat the impacted data streams as compromised once exploitation is suspected.

Confidentiality impact is High: the victim tenant's subsequently ingested data is exposed to the attacker. Integrity impact is High: the advisory explicitly notes the data is subject to unauthorized modification. Availability impact is High per the CVSS vector, reflecting that victim data "prevented from reaching its intended destination" constitutes a denial of the expected ingestion path — downstream dashboards, detections, and analytics that depend on that data stream silently lose fidelity. With AV:N and AC:L, exploitation does not require local access or unusual conditions; with PR:L, the blast radius is gated by how widely Fleet package-management rights are delegated. UI:N means no victim action is required, and S:U means the compromise stays within the same CVSS security authority, consistent with the advisory's clarification that tenants are users or teams within one deployment rather than separate Elastic Cloud organizations.

Persistence is the most operationally significant aspect: because interception continues after the malicious package is removed, incident responders cannot treat package deletion as containment. The affected infrastructure — the index and ingest-pipeline settings applied to the victim's data stream — must be identified and remediated independently. This raises the cost and duration of containment and increases the likelihood of missed or repeated data loss between detection and full remediation.

Detection Guidance

Sigma Rule

title: Kibana Fleet Package Installation Data Stream Identifier Claim
id: 7f3c1a92-5b6e-4d21-9c8a-2e4b7d1f0c33
status: experimental
description: Detects Kibana Fleet package installation activity that may claim a data stream identifier already in use by another tenant (CVE-2026-102406, CWE-639). Correlate with creation or modification of index templates and ingest pipelines on pre-existing data streams.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102406
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: elastic
  service: kibana
detection:
  selection_package:
    event.action:
      - "fleet-package-install"
      - "package_install"
      - "install_package"
  selection_stream:
    data_stream.name|contains: "-"
  filter_authorized:
    user.roles|contains: "superuser"
  condition: selection_package and selection_stream and not filter_authorized
falsepositives:
  - Legitimate delegated Fleet package management by authorized teams
level: high
tags:
  - attack.t1078
  - cve.2026.102406

YARA Rule

rule CVE_2026_102406_Kibana_Fleet_DataStream_Hijack
{
    meta:
        description = "Detects Kibana Fleet package artifacts that reference pre-existing data stream identifiers, consistent with CWE-639 authorization bypass in CVE-2026-102406"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102406"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fleet = "fleet" ascii nocase
        $pkg = "package" ascii nocase
        $ds1 = "data_stream" ascii nocase
        $ds2 = "data-stream" ascii nocase
        $idx1 = "index_template" ascii nocase
        $idx2 = "index-template" ascii nocase
        $pipe1 = "ingest_pipeline" ascii nocase
        $pipe2 = "ingest-pipeline" ascii nocase

    condition:
        filesize < 5MB and
        $fleet and $pkg and
        ($ds1 or $ds2) and
        ($idx1 or $idx2 or $pipe1 or $pipe2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102406 Kibana Fleet package installation referencing data stream identifier"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/fleet"; nocase; http.uri; content:"package"; nocase; http.request_body; content:"data_stream"; nocase; http.request_body; content:"index_template"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-102406; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102406; sid:2026102406; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.action in ("fleet-package-install","package_install","install_package") and
      kibana.space.id != null ]
  [ any where event.category == "database" and
      event.action in ("index_template_put","ingest_pipeline_put","data_stream_update") and
      not user.roles : "superuser" ]

Splunk SPL Query

index=kibana OR index=elasticsearch sourcetype IN ("kibana:audit","elasticsearch:audit")
(event.action IN ("fleet-package-install","package_install","install_package","index_template_put","ingest_pipeline_put","data_stream_update") OR event_type="PackageInstallation")
| eval actor=coalesce(user.name, user.id, "unknown")
| eval stream=coalesce(data_stream.name, data_stream, "unknown")
| stats count min(_time) as first_seen max(_time) as last_seen values(event.action) as actions by actor stream
| where count > 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table actor stream actions count first_seen last_seen
| sort - count

Wazuh OSSEC Rule

<group name="kibana,fleet,cve-2026-102406,">
  <rule id="100406" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">^fleet-package-install|package_install|install_package$</field>
    <field name="user.roles" negate="yes">superuser</field>
    <description>CVE-2026-102406: Kibana Fleet package installation by non-admin user - possible data stream identifier claim</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authorization_bypass,cross_tenant,</group>
  </rule>
  <rule id="100407" level="13">
    <if_sid>100406</if_sid>
    <field name="data_stream.name">.+</field>
    <description>CVE-2026-102406: Fleet package installation referencing existing data stream identifier - potential cross-tenant interception</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authorization_bypass,cross_tenant,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict delegated Fleet package-management privileges to the smallest possible set of trusted principals, since the vulnerability requires a user with those rights and explicitly does not require Elasticsearch administrative privileges. Audit all existing delegated roles and remove Fleet package-management rights from users and teams that do not require them. Review currently installed Fleet packages for index and ingest-pipeline settings that reference data stream identifiers not owned by the installing principal. Enable and retain Kibana and Elasticsearch audit logging to capture package installation events and template/pipeline mutations. If delegation cannot be safely restricted, disable self-service Fleet package installation until vendor guidance is available.

2. Patch/upgrade steps. No vendor fix is currently available for CVE-2026-102406. Monitor the Elastic security advisories page and the NVD entry for CVE-2026-102406 for a fixed Kibana release, then upgrade all Kibana nodes in the deployment. Because interception can continue after a malicious package is removed, upgrading alone is insufficient if the attack already occurred: the index and ingest-pipeline settings applied to affected data streams must be reviewed and repaired separately.

3. Long-term hardening. Treat delegated Fleet package management as a privileged capability and govern it accordingly with role-based access control, least privilege, and periodic entitlement reviews. Implement monitoring that alerts on mutations to pre-existing data streams, index templates, and ingest pipelines by non-administrative principals. Establish a baseline of legitimate data stream ownership per tenant and alert on deviations. Apply network segmentation and access controls around the Fleet and Elasticsearch APIs. Maintain an incident response runbook that includes verifying data stream destinations after any suspected Fleet package abuse, given the persistence property described in the advisory.

References

• NVD — CVE-2026-102406: https://nvd.nist.gov/vuln/detail/CVE-2026-102406
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• Elastic Security Advisories (monitor for the Kibana advisory corresponding to CVE-2026-102406): https://www.elastic.co/community/security
• CVSS v3.1 Specification — vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: https://www.first.org/cvss/v3.1/specification-document
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-102406 in the data provided. The vulnerability is not listed in CISA KEV, no public PoC or exploit code is available, and no EPSS score has been assigned by FIRST.org.