{"id":"CVE-2026-102410","summary":"Missing Authorization in Kibana Leading to Information Disclosure","details":"Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.","modified":"2026-10-11T07:05:32.874302183Z","published":"2026-10-06T19:31:41.977Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102410.json","unresolved_ranges":[{"extracted_events":[{"introduced":"9.2.0"},{"last_affected":"9.3.8"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"elastic","cwe_ids":["CWE-862"]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102410.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102410"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"25d88452371273dd27356c98598287b669a03eae"},{"fixed":"2e8528e92361c3399724226deaf2b46f933e925b"}],"database_specific":{"extracted_events":[{"introduced":"9.2.0"},{"fixed":"9.4.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102410.json","vanir_signatures":[{"digest":{"line_hashes":["103342112600954278286142847383922400225","288243627735207210283395129633368368500","214657873005854953012582699966756484076","122451077620776267755292899004238151248","99529506029800964019912057423548639551","324564415822998438389102230173689826155","75560001542922593622241142304738526916","72605904973352755096422300208785552255","145318543232505712500442222983989209660","276278406786812896856162244577732446624","170988723049860118564215508252741259182","303327935685576403107648419763289621285"],"threshold":0.9},"id":"CVE-2026-102410-130e8bd0","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b","target":{"file":"x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/LimitBy.java"},"deprecated":false},{"target":{"file":"x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/Aggregate.java"},"deprecated":false,"digest":{"line_hashes":["161056613919037596757166630608870537736","86378824111358672557185578609009983071","215091713476600073227784711664373198391","189585869385156807530975736855838138911","279202746657538887980591458848696375036","284875980325502938034705174134146547692","66979061543498960786738644373098932172","266221552125803469155987949378050418646","298712739933869688539396112040870736090","216223514405330271829164924688414613086","122015335809201108851942394655163742139","58488839457620041740211438657164329180","165831797341159194441400826404093626692"],"threshold":0.9},"id":"CVE-2026-102410-2c8925d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b"},{"target":{"file":"x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/analysis/VerifierTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["163388955049760856637126732105830050942","221926605359504672797536370148741789499","254656951684854102726521523986504562991"]},"id":"CVE-2026-102410-6c1267d5","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/2e8528e92361c3399724226deaf2b46f933e925b","target":{"function":"postAnalysisVerification","file":"x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plan/logical/Aggregate.java"},"deprecated":false,"digest":{"function_hash":"302529434342987997879690507701028181460","length":1250},"id":"CVE-2026-102410-cf7293c2"}],"vanir_signatures_modified":"2026-10-11T07:05:32Z"}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"68626ce831ffb8e4138bb24ba8762a15a569a41c"},{"fixed":"b2e39752e03b56f48f51943214475ddba1f8e974"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"9.2.0"},{"fixed":"9.4.0"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102410.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}