CVE-2026-102410: 
Kibana vulnerability analysis and mitigation

CVE-2026-102410 is a Missing Authorization vulnerability (CWE-862) in Elastic Kibana's Metrics Experience feature that enables information disclosure by authenticated users with insufficient privileges. An internal API endpoint within the feature failed to enforce Kibana-level authorization checks that a related API in the same feature correctly enforced, allowing users with only data-store-level read access to retrieve restricted metric data. The vulnerability affects Kibana versions 9.2.0 through 9.3.8 and was published on October 6, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Elastic Advisory).

The root cause is CWE-862 (Missing Authorization), classified under CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). Within Kibana's Metrics Experience feature, an internal API surface was inconsistently secured — a related API in the same feature correctly enforced Kibana feature-level privilege checks, but this internal API did not. An authenticated user possessing only Elasticsearch index-level read permissions, without any corresponding Kibana feature privilege for Metrics Experience, could directly call this unprotected internal API over the network to retrieve index-derived metric data that the properly-authorized API would have blocked. No public proof-of-concept code has been identified (GitHub Advisory, Elastic Advisory).

Successful exploitation results in unauthorized information disclosure of index-derived metric data within Kibana's Metrics Experience feature. An authenticated attacker with only data-store read access can bypass Kibana's feature-level access controls to view metric data they are not privileged to see, violating the principle of least privilege. There is no impact on data integrity or system availability, and the scope of impact is limited to the confidentiality of metric data accessible through the affected internal API (GitHub Advisory, Elastic Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for this vulnerability. The EPSS score is approximately 0.206%, indicating a low probability of exploitation within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable (GitHub Advisory, Elastic Advisory).

Elastic has addressed this vulnerability in Kibana 9.4.0; users running versions 9.2.0 through 9.3.8 should upgrade to 9.4.0 or later. As interim measures, administrators should audit and tighten user access permissions to ensure that Kibana feature privileges are explicitly granted and aligned with data-store access levels, rather than relying solely on index-level permissions. Monitoring API access logs for unusual Metrics Experience API calls from users who hold only data-store read permissions can help detect potential abuse (Elastic Advisory, GitHub Advisory).