CVE-2026-102410

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked.

• CWE-862

• https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864Vendor Advisory

Published

Oct 6, 2026

Last Modified

Oct 9, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102404Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-102406Authorization Bypass Through User-Controlled Key (CWE-639) i…8.8
• CVE-2026-102407Incorrect Authorization (CWE-863) in Elasticsearch can lead …5.4
• CVE-2026-102408Inefficient Regular Expression Complexity (CWE-1333) in Elas…4.3
• CVE-2026-102409Uncontrolled Recursion (CWE-674) in Elasticsearch can allow …6.5
• CVE-2026-10241A security flaw has been discovered in jeecgboot The server …6.3
• CVE-2026-102411Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-102412Incorrect Authorization (CWE-863) in Kibana can lead to sens…6.5
• CVE-2026-102413Uncaught Exception (CWE-248) in Elastic Endpoint can lead to…6.2
• CVE-2026-102414pbkdf2 through 3.1.6 re-hashes passwords longer than the dig…3.7
• CVE-2026-10242A weakness has been identified in itsourcecode Content Manag…6.3
• CVE-2026-102422shell-quote's `quote()` function emits a `{ comment }` token…8.1