Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-08 | 2 | Disclosure2 |
| 2026-04-13 | 1 | Disclosure1 |
⚠️ Vulnerabilidades en productos Elastic ❗ CVE-2026-4498 ❗ CVE-2026-33466 ❗ CVE-2026-33461 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-elastic-2/ https://t.co/9mpmyikW4w
Post summary
The post lists three Elastic CVEs and directs readers to a CERT link for more information.
CVE-2026-4498 Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope v… https://www.cve.org/CVERecord?id=CVE-2026-4498
Post summary
The tweet announces a vulnerability (CVE‑2026‑4498) in Kibana’s Fleet plugin, detailing its privilege‑escalation nature and potential data leakage, but provides no exploit or remediation information.
CVE-2026-4498 Privilege Abuse in Kibana Fleet Plugin Debug Route Handlers Enables Unauthorized Index Data Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4498
Post summary
CVE-2026-4498 is a newly disclosed privilege‑escalation vulnerability in Kibana Fleet Plugin’s debug route handlers that permits unauthorized access to index data.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | elastic | kibana | - | - | - |