## Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)

- 種別: advisory
- 関連技術: elasticsearch
- 公開日時: 2026-10-06T18:36:48.000Z
- 情報源: Elastic Security Announcements (https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860)
- パーマリンク: https://vulnpulse.app/items/elastic-security-d982e2a72ba5

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Bec…