CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-102412

Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used.

Score
6.5 medium
Published
2026-10-06
Links
NVD · cve.org

Matched ports (3)

PortPackageVersionStatusMaintainer
textproc/kibana93kibana939.3.8unaddressedelastic@FreeBSD.org
textproc/kibana94kibana949.4.7unaddressedelastic@FreeBSD.org
textproc/kibana95kibana959.5.4unaddressedelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana93</name>
	<range><lt>9.4.8</lt></range>
      </package>
      <package>
	<name>kibana94</name>
	<range><lt>9.4.8</lt></range>
      </package>
      <package>
	<name>kibana95</name>
	<range><lt>9.4.8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Incorrect Authorization (CWE-863) in Kibana can lead to sensitive
	information disclosure via Accessing Functionality Not Properly
	Constrained by ACLs (CAPEC-1). An authenticated Kibana user with
	limited Fleet management privileges could access sensitive credential
	material that should be restricted to users with Fleet settings
	administrative access. Successful exploitation could allow an attacker
	to obtain private cryptographic key material configured for Fleet
	Server host connections, potentially enabling impersonation of trusted
	Fleet infrastructure components in deployments where those keys are
	actively used.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-102412</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-102412</url>
    </references>
    <dates>
      <discovery>2026-10-06</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>