Bypass Record
Exploitation for Priv-Esc × Elastic Kibana Fleet
A publicly-reported instance of Exploitation for Priv-Esc bypassing Elastic Kibana Fleet, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
Improper input validation in the configuration override mechanism of Kibana Fleet agent policy management. An attacker with Fleet management privileges injects crafted values into agent policy configuration, leading to issuance of API keys with excessive Elasticsearch privileges, bypassing intended role restrictions.
Detection & mitigation
Monitor Kibana audit logs for modifications to Fleet agent policies, especially changes to configuration overrides that include unexpected or suspicious values. Mitigate by applying the vendor patch for CVE-2026-49095 and enforcing strict input validation on agent policy configurations.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.