Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Kibana Fleet can leak Elastic Agent API keys

CVE-2026-72632 · published 2 months ago
Summary

Kibana's Fleet feature tries to hide the secret token (API key) that lets an Elastic Agent talk to Elasticsearch, but it still lets users ask whether the token matches a pattern. By sending many small queries and watching how many agents are reported, an attacker can piece together the full token one character at a time. Upgrade to the patched version or restrict who can use the Fleet listing and filter functions to stop the leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
elastic kibana <= 8.19.19
>= 8.19.0, < 8.19.20
>= 9.0.0, < 9.4.5
9.5.0
Original advisory text
Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-203Observable Discrepancy
Timeline
Published13 Aug 2026
Updated4 Nov 2026
First seen13 Aug 2026
Sources
CVE-2026-72632 · OSV
CVE-2026-72632 · NVD
CVE-2026-72632 · MITRE
Track software like this
Free during beta