PT-2026-31335 · Elastic · Kibana+1

Ismisepaul + 1 · Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-4498

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Kibana’s Fleet plugin debug route handlers exhibit execution with unnecessary privileges, potentially allowing authenticated users with Fleet sub-feature privileges to read index data beyond their authorized Elasticsearch RBAC scope. This occurs through privilege abuse.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

BIT-ELK-2026-4498

BIT-KIBANA-2026-4498

CVE-2026-4498

Affected Products

Fleet

Kibana

References · 7

• https://osv.dev/vulnerability/BIT-elk-2026-4498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4498 · Security Note
• https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2026-4498 · Vendor Advisory
• https://t.me/CVEtracker/50077 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2041939667424051485 · Twitter Post
• https://twitter.com/CVEnew/status/2041975636063920466 · Twitter Post