CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-72631

Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents

Score
6.5 medium
Published
2026-08-13
Links
NVD · cve.org

Matched ports (4)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org
textproc/kibana93kibana939.3.8possibly backportedelastic@FreeBSD.org
textproc/kibana94kibana949.4.7fixed by updateelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>9.4.5</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>9.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Improper Privilege Management (CWE-269) in Kibana Fleet can lead to
	privilege escalation via Privilege Escalation (CAPEC-233). An
	integration policy may optionally declare extra data streams that the
	integration writes to, which Fleet adds to the Elasticsearch API key
	issued to Elastic Agents enrolled in the corresponding agent policy.
	The resulting key allows new documents to be inserted and index
	mappings to be extended for specific indices. The key does not allow
	reading, updating, or deleting existing documents</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-72631</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-72631</url>
    </references>
    <dates>
      <discovery>2026-08-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>