{
  "id": 14572336,
  "title": "Shared Elasticsearch clusters and the stream-claim flaw rated 8.8",
  "url": "https://urgent.news/2026/10/15/shared-elasticsearch-clusters-and-the-stream-claim-flaw-rated-8-8",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T00:40:44.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/shared-elasticsearch-clusters-and-the-stream-claim-flaw-rated-88-4198"
  },
  "original_language": "en",
  "account": "Elastic's October 2026 advisory batch contains a critical vulnerability rated 8.8 in CVSS v3, making it the most severe entry. This flaw, CVE-2026-102406, stems from shared Elasticsearch clusters and a Kibana Fleet package installer that can be exploited by users with delegated package rights. Out of 14 advisories, 3 are rated High and 11 as Medium, with no confirmed exploitation in the wild. The mechanism involves delegated package rights to claim another team's data stream, potentially redirecting data through controlled infrastructure.\n\nThe impact is far-reaching as it affects telemetry, alerts, dashboards, and retention decisions. Vulnerable products include Elasticsearch (8.x to 8.19.22, 9.4.7 and 9.5.4) and Kibana (8.14.0 through 9.5.3). Related advisories include CVE-2026-103007, CVE-2026-103009, and CVE-2026-102412. ZoomEye reported 161,744 instances of vulnerable Kibana deployments on 2026-10-07, though the CVE key has not yet been indexed. To mitigate, upgrade Elasticsearch to 8.19.23, 9.4.8 or 9.5.5 and Kibana on matching branches. Additionally, review and restrict delegated Fleet package rights and role-management privileges to ensure each data stream remains attributed to its rightful owner.",
  "summary": "Shared Elasticsearch clusters and the stream-claim flaw rated 8.8 Vulnerability overview CVE-2026-102406 is the highest-rated entry in Elastic's October 2026 advisory batch: CVSS v3 8.8, CWE-639, and a Kibana Fleet package installer that can be steered by a user with delegated package rights. Elastic rates three of the batch's 14 advisories High and eleven Medium, and records no confirmed…",
  "key_points": [
    "Critical Elasticsearch vulnerability CVE-2026-102406 rated 8.8 in CVSS v3",
    "Shared clusters and Kibana Fleet installer exploited via delegated package rights",
    "161,744 vulnerable Kibana deployments reported as of 2026-10-07"
  ],
  "editors_take": "Flawed delegation of package rights in shared clusters allows unauthorized users to hijack data streams, compromising the integrity of critical telemetry, dashboards, and alerting systems across vulnerable deployments.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}