CVE-2026-102410

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102410
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102410.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102410
Downstream
MINI (2)
Published
2026-10-06T19:31:41Z
Modified
2026-10-11T07:05:32Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Missing Authorization in Kibana Leading to Information Disclosure
Details

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102410.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.2.0"
                },
                {
                    "last_affected": "9.3.8"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
25d88452371273dd27356c98598287b669a03eae
Fixed
2e8528e92361c3399724226deaf2b46f933e925b
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.2.0"
        },
        {
            "fixed": "9.4.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102410.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "103342112600954278286142847383922400225",
                "288243627735207210283395129633368368500",
                "214657873005854953012582699966756484076",
                "122451077620776267755292899004238151248",
                "99529506029800964019912057423548639551",
                "324564415822998438389102230173689826155",
                "75560001542922593622241142304738526916",
                "72605904973352755096422300208785552255",
                "145318543232505712500442222983989209660",
                "276278406786812896856162244577732446624",
                "170988723049860118564215508252741259182",
                "303327935685576403107648419763289621285"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102410-130e8bd0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b",
        "target": {
            "file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/LimitBy.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "161056613919037596757166630608870537736",
                "86378824111358672557185578609009983071",
                "215091713476600073227784711664373198391",
                "189585869385156807530975736855838138911",
                "279202746657538887980591458848696375036",
                "284875980325502938034705174134146547692",
                "66979061543498960786738644373098932172",
                "266221552125803469155987949378050418646",
                "298712739933869688539396112040870736090",
                "216223514405330271829164924688414613086",
                "122015335809201108851942394655163742139",
                "58488839457620041740211438657164329180",
                "165831797341159194441400826404093626692"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102410-2c8925d1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b",
        "target": {
            "file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/Aggregate.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "163388955049760856637126732105830050942",
                "221926605359504672797536370148741789499",
                "254656951684854102726521523986504562991"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102410-6c1267d5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b",
        "target": {
            "file": "x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/analysis/VerifierTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "302529434342987997879690507701028181460",
            "length": 1250
        },
        "id": "CVE-2026-102410-cf7293c2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b",
        "target": {
            "file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/Aggregate.java",
            "function": "postAnalysisVerification"
        }
    }
]
vanir_signatures_modified 
"2026-10-11T07:05:32Z"

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
68626ce831ffb8e4138bb24ba8762a15a569a41c
Fixed
b2e39752e03b56f48f51943214475ddba1f8e974
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.2.0"
        },
        {
            "fixed": "9.4.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102410.json"