Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
Description:
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
Affected Versions:
- All versions from 8.19.0 up to and including 8.19.19
- All versions from 9.0.0 up to and including 9.4.4
- Version 9.5.0
Affected Configurations:
All configurations are affected.
Solutions and Mitigations:
The issue is resolved in versions 8.19.20, 9.4.5, and 9.5.1.
Fleet no longer accepts caller-supplied filter expressions over fields that hold API key material, so the agent listing result count no longer reveals anything about those values.
For Users that Cannot Upgrade:
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 7.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVE ID: CVE-2026-72632
Problem Type: CWE-203 - Observable Discrepancy
Impact: CAPEC-116 - Excavation