Urgent.News

What's breaking now, across thousands of outlets.

Thursday, 15 October 2026 Reading Room

Tech

Shared Elasticsearch clusters and the stream-claim flaw rated 8.8

Shared Elasticsearch clusters and the stream-claim flaw rated 8.8 Vulnerability overview CVE-2026-102406 is the highest-rated entry in Elastic's October 2026 advisory batch: CVSS v3 8.8, CWE-639, and a Kibana Fleet package installer that can be steered by a user with delegated package rights. Elastic rates three of the batch's 14 advisories High and eleven Medium, and records no confirmed…

dev.to ·

Elastic's October 2026 advisory batch contains a critical vulnerability rated 8.8 in CVSS v3, making it the most severe entry. This flaw, CVE-2026-102406, stems from shared Elasticsearch clusters and a Kibana Fleet package installer that can be exploited by users with delegated package rights. Out of 14 advisories, 3 are rated High and 11 as Medium, with no confirmed exploitation in the wild.

The mechanism involves delegated package rights to claim another team's data stream, potentially redirecting data through controlled infrastructure.

The impact is far-reaching as it affects telemetry, alerts, dashboards, and retention decisions. Vulnerable products include Elasticsearch (8.x to 8.19.22, 9.4.7 and 9.5.4) and Kibana (8.14.0 through 9.5.3). Related advisories include CVE-2026-103007, CVE-2026-103009, and CVE-2026-102412. ZoomEye reported 161,744 instances of vulnerable Kibana deployments on 2026-10-07, though the CVE key has not yet been indexed.

To mitigate, upgrade Elasticsearch to 8.19.23, 9.4.8 or 9.5.5 and Kibana on matching branches. Additionally, review and restrict delegated Fleet package rights and role-management privileges to ensure each data stream remains attributed to its rightful owner.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Capacitor Push Notifications for Lovable

Push is the feature that usually makes founders give up on the PWA route and wrap their Lovable app properly. A web app on iPhone only gets push after the user adds it to the home screen, and almost…

  • Capacitor push notifications simplify PWA push notifications on iOS and Android.
  • Detailed guide covers setup on iOS and Android, avoiding common pitfalls.
  • Paid Apple Developer account required for iOS silent push notifications.

·dev.to

Building Production-Ready SaaS and CRM Systems with Node.js and Next.js in Kerala

Introduction to Modern SaaS and CRM Engineering Building enterprise-grade Software-as-a-Service (SaaS) and Customer Relationship Management (CRM) platforms requires a delicate balance of rapid MVP…

  • Node.js and Next.js used to build production-ready SaaS and CRM systems in Kerala
  • TypeScript adopted for enhanced developer experience and code reliability
  • Next.js 15 with React Server Components optimizes high-performance CRM dashboards

·dev.to

Lobby Host Succession Explained: 4 Rules After a Player Disconnect

The hard trade-off is speed versus truth: reassigning a lobby host on the first broken socket feels responsive, but it can create two hosts during a brief network interruption.

  • Assign unique connectiongeneration to each successful connection.
  • Use heartbeat extension to extend matching connectiongeneration.
  • Four invariants ensure predictable host succession process.

·dev.to

Daily Pokémon Battle Game

I Built a Daily Pokémon Battle Game as a Browser-Based Strategy Puzzle I wanted to explore whether a turn-based battle could work as a small daily puzzle instead of an endless progression system.

  • Daily Pokémon battle game called Daily Red Pokémon
  • Players face same six-Pokémon team each day
  • Game operates without backend, hosted statically

·dev.to

More from Thursday 15 October →