CVE-2026-102406

{
  "etk_id": "ETK-2026-805",
  "cve_id": "CVE-2026-102406",
  "display_id": "CVE-2026-102406",
  "ghsa_id": "GHSA-gpr2-2mpc-hvf2",
  "euvd_id": "EUVD-2026-93927",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Kibana Fleet package installation",
  "summary": "Kibana Fleet package installation can let a delegated package manager claim a data stream identifier already used by another tenant on the same deployment. An attacker with that privilege may cause subsequently ingested data to be exposed, altered, or diverted from its intended destination.",
  "mitigation": "Restrict Fleet package-management privileges to trusted administrators and audit data streams, index settings, and ingest pipelines for unexpected ownership or routing changes. No fixed release is recorded in the supplied advisory data; remediate any altered infrastructure separately after removing a malicious package.",
  "vendor": "Elastic",
  "product": "Kibana",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.14.0, <= 8.19.21",
        ">= 9.0.0, <= 9.4.6",
        ">= 9.5.0, <= 9.5.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Kibana",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0034,
  "epss_percentile": 0.2559,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 32.35727925,
  "t0_at": "2026-10-06T19:31:36.178000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-06T19:31:36.178000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T19:31:36.178000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102406"
    }
  }
}