CVE-2026-72631 — Threat Intelligence Report

NOTICE: This vulnerability is UNPATCHED (Patch Confidence: 0/4). No vendor fix, workaround, or official mitigation exists at the time of writing. Organizations using affected Kibana/Fleet deployments should treat this as an active risk.

Executive Summary

CVE-2026-72631 is an improper privilege management vulnerability (CWE-269) in the Kibana Fleet module that permits a low-privileged authenticated user to achieve unauthorized data integrity impacts against Elasticsearch indices. An attacker can exploit the flaw to insert new documents and extend index mappings into indices they should not have write access to, although they cannot read, update, or delete existing documents. At the time of writing, no patch is available, and the vendor has not published any mitigation; organizations relying on Kibana Fleet should treat this as an unmitigated privilege escalation risk.

Technical Analysis

The vulnerability resides in the Fleet functionality of Kibana, a component responsible for managing Elastic Agent policies and their associated integrations. The root cause is a failure to properly enforce privilege boundaries when constructing the Elasticsearch API key issued to Elastic Agents.

Vulnerability mechanism: An integration policy (a configuration that defines how a given data source integration operates) may optionally declare "extra data streams." Data streams in Elasticsearch are time-series indices that share a common backing index and are typically restricted to specific namespaces. When an integration declares extra data streams, the Fleet module incorporates these into the permissions granted via the API key issued to Elastic Agents enrolled in the corresponding agent policy. The result is that the generated API key gains write-level permissions (document insertion and index mapping extension) for the indices associated with those designated data streams — even though the requesting user or agent policy should not have such permissions.

Key technical details from the advisory:

• The vulnerability is classified under CWE-269: Improper Privilege Management.
• The attack pattern is CAPEC-233: Privilege Escalation.
• The NVD description explicitly states the resulting API key "allows new documents to be inserted and index mappings to be extended for specific indices."
• Importantly, the description notes: "The key does not allow reading, updating, or deleting existing documents."

Attack surface: The attack surface is the Kibana Fleet API, reachable over the network (CVSS vector: AV:N). Exploitation requires low-privilege authentication (PR:L in the CVSS vector), meaning the attacker must have some form of authenticated access to the Fleet module, but not administrative or superuser privileges. The privilege escalation path is via the manipulation of integration policies to declare extra data streams that grant write access to arbitrary indices.

No specific code paths, function names, or parameter identifiers are disclosed in the NVD description. The vulnerability class indicates a privilege management flaw during the API key generation and permission scoping process within the Fleet module.

Exploitation Scenarios

Threat actor profile: A low-privileged authenticated user of the Kibana Fleet module. This could be a rogue insider, a compromised low-privilege account, or an attacker who has achieved initial access through a separate vulnerability.

Attack chain (inferred from vulnerability class):

1. Reconnaissance/identification: The attacker identifies that their account has access to the Fleet integration policy management interface. They enumerate existing agent policies and integration configurations to understand which indices are currently referenced.

2. Triggering the flaw: The attacker creates or modifies an integration policy, declaring "extra data streams" that reference target indices outside their legitimate scope. Because the Fleet module lacks proper privilege validation on which data streams can be declared, the system accepts the policy modification.

3. Execution (privilege escalation): Upon policy activation/enrollment, the Fleet module generates an Elasticsearch API key for the corresponding agent policy. Due to the privilege management flaw, this API key inherits write permissions (create/insert and mapping extension) for the indices associated with the attacker-declared data streams. The attacker then uses this API key to submit requests directly to the Elasticsearch cluster.

4. Post-exploitation: The attacker leverages the API key's write permissions to:

   • Insert forged or malicious documents into targeted indices (data integrity violation).
   • Extend index mappings, potentially interfering with the schema and consuming storage resources.
   • Potentially launch further attacks by injecting documents that may be processed by downstream consumers (e.g., alerting rules, SIEM pipelines).

Important constraint: The attacker cannot read, update, or delete existing documents with the compromised key. This restricts the attack to data integrity violations (e.g., poisoning data, injecting false telemetry, manipulating records used in dashboards) rather than data exfiltration or destruction.

PoC/exploit status: No public proof-of-concept, Nuclei template, or exploit code is available. The attack chain described above is inferred from the vulnerability class and the NVD description. Organizations should not assume the absence of private exploits.

Impact Assessment

CVSS breakdown (score: 6.5 — Medium/High):

Business impact:

• Data integrity compromise: An attacker can insert unauthorized documents into Elasticsearch indices, corrupting data used for analytics, monitoring, and security detection. This can poison dashboards, produce false alerts, and undermine the trustworthiness of log/siem data.
• Mapping exhaustion: By extending index mappings, the attacker can bloat indices, degrade query performance, and potentially cause instability in the Elasticsearch cluster.
• Downstream contamination: If the compromised indices feed into alerting rules, machine learning jobs, or other automation, an attacker can manipulate the inputs to cause incorrect actions.

Affected systems: Kibana deployments with the Fleet module enabled and Elastic Agents enrolled. The exact affected versions are not disclosed; any environment using Fleet for integration/agent policy management is potentially at risk.

Blast radius: The vulnerability grants authenticated low-privilege users the ability to write to arbitrary indices that the Fleet-managed agents' API keys can reach. Because the flaw is in policy creation and API key scoping, the blast radius is bounded by the Elasticsearch cluster's index structure but otherwise broad across all indices the Fleet agent key has write access to.

Detection Guidance

Sigma Rule

title: Detect Unauthorized Index Document Insertion via Fleet API Key
id: 1e0d3f2a-5c9b-4c8e-9e2d-7a3b4f5c6d7e
status: experimental
description: Detects insertion of documents into Elasticsearch indices via API keys derived from Kibana Fleet integration policies, which may indicate CVE-2026-72631 exploitation.
logsource:
  category: application
  product: elasticsearch
detection:
  selection:
    type: 'doc'
    indices: 'index_creation'
  filter_known_agents:
    user.agent.name: 'Elastic-Artillery/*'  # Legitimate agent patterns
    user.agent.name|startswith: 'elastic-agent'
  condition: selection and not filter_known_agents
falsepositives:
  - Legitimate Fleet policy deployments
level: medium

YARA Rule

rule CVE_2026_72631_Fleet_Policy_Manipulation
{
    meta:
        description = "Detects integration policy content pattern indicative of privilege escalation via extra data streams"
        author = "Valter Sit Threat Intel"
        date = "2026-01-01"
        reference = "CVE-2026-72631"
    strings:
        $s1 = "data_stream" ascii wide nocase
        $s2 = "extraDataStream" ascii wide nocase
        $s3 = "create_doc" ascii wide nocase
        $s4 = "indices" ascii wide nocase
        $s5 = "mapping" ascii wide nocase
    condition:
        (uint16(0) == 0x7B5B or uint16(0) == 0x5B7B or filesize < 1MB) and
        2 of ($s*) and 
        (all of ($s1, $s2) or all of ($s3, $s4, $s5))
}

Rule is an indicative heuristic; adjust strings based on observed policy formats.

Suricata IDS Rule

alert http any any -> $ELASTICSEARCH_SERVERS any (msg:"CVE-2026-72631 - Kibana Fleet API Key write to unauthorized index"; flow:to_server,established; content:"_bulk"; http_uri; content:"index"; http_uri; content:"api_key"; http_header; pcre:"/index\s*\x3A\s*\"[^\"]+\"/i"; classtype:attempted-admin; sid:202672631; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-72631, mitre_tactic_id T1068, mitre_tactic_name Exploitation_for_Privilege_Escalation;)

Rule detects bulk index operations carrying an API key header, which may indicate a compromised Fleet-generated key.

Elastic Detection

sequence by host.id with maxspan=5s
  [authentication where event.action == "login_success" and user.name != "elastic" and user.name != "kibana" and source.ip != "127.0.0.1"]
  [file where event.action == "creation" and file.name == "*.json" and file.path contains "fleet" ]
  [network where event.action == "connection" and destination.port == 9200 and network.protocol == "http" and http.request.method == "POST" and url.path == "/_bulk"]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:index
| where like(_raw, "%\"result\":\"created\"%") OR like(_raw, "%_bulk%")
| eval is_fleet_key = if(like(auth_header, "%ApiKey%"), 1, 0)
| eval is_agent = if(like(user_agent, "%elastic-agent%") OR like(user_agent, "%Elastic-Artillery%"), 1, 0)
| where is_fleet_key=1 AND is_agent=0
| stats count min(_time) max(_time) by index, user, src_ip, api_key_id
| where count > 100
| table _time, index, user, src_ip, api_key_id, count

Wazuh OSSEC Rule

<group name="elasticsearch,">
  <rule id="448592" level="12">
    <decoded_as>json</decoded_as>
    <field name="type">^doc$</field>
    <field name="result">^created$</field>
    <field name="user">^(?!elastic$|kibana$)</field>
    <description>Elasticsearch - Potential CVE-2026-72631 exploitation - unauthorized index document insertion via Fleet-issued key</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED (0/4 confidence). No vendor patch, advisory, or official workaround is available from any tracked source at the time of writing.

Immediate Mitigations (compensating controls)

1. Restrict Fleet Access: Limit access to the Kibana Fleet module and integration policy management to only highly trusted administrators. The vulnerability requires authenticated low-privilege access; reducing that attack surface reduces risk.
2. Enable Elasticsearch Security: Ensure Elasticsearch security features are enabled and that field-level and document-level security (FLS/DLS) is applied to restrict what the agent API keys can do.
3. Monitor API Key Permissions: Regularly audit the permissions of API keys issued to Elastic Agents. Look for keys that reference unexpected or broad index patterns.
4. Network Segmentation: Restrict network access to Kibana and Elasticsearch clusters from untrusted zones.
5. Enable Audit Logging: Ensure audit logging is enabled in the Elastic Stack to capture index operations, API key usage, and policy changes.

Patch/Upgrade Steps

1. Track Elastic's official security advisory channels (Elastic Security Advisories RSS, elastic.co/community/security) for a fix.
2. When a patch is released, upgrade Kibana and any related Fleet components following Elastic's official upgrade procedure.
3. Validate the patch by testing integration policies after upgrading to ensure API key scoping is properly enforced.

Long-Term Hardening

1. Implement the principle of least privilege by auditing all Fleet agent policy configurations.
2. Use role-based access control (RBAC) in Kibana to separate administrative functions.
3. Deploy network-based intrusion detection (Suricata) rules and host-based monitoring (Wazuh/Sigma) to alert on anomalous Elasticsearch write activity.
4. Join CISA's Known Exploited Vulnerabilities (KEV) catalog monitoring to detect active exploitation status changes.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72631
2. Elastic Security Advisory (pending): https://www.elastic.co/community/security — check for upcoming advisory
3. MITRE ATT&CK — T1068: Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. CWE-269: Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
5. CAPEC-233: Privilege Escalation: https://capec.mitre.org/data/definitions/233.html

Threat actor campaigns / in-the-wild exploitation: No known campaigns or exploitation-in-the-wild evidence has been reported. CISA KEV listing is NO. Given the unpatched status, active exploitation may be undetected or undeclared; organizations should prioritize monitoring.

Report generated by Valter Sit Threat Intelligence — v1.0 | Classification: TLP:CLEAR