Improper input validation in the Kibana Fleet agent policy management feature allows an authenticated user with Fleet management privileges to craft malicious configuration overrides. By injecting unvalidated values, the attacker can have Elastic Agents receive API keys that carry elevated privileges. These keys can grant unauthorized read and write access to sensitive Elasticsearch security indices, effectively raising the attacker's access level beyond the intended Fleet role.

The vulnerability affects Elastic Kibana deployments that use the Fleet agent management feature. The CVE description does not specify particular Kibana or Fleet versions, so any environment running Kibana with Fleet enabled and where the agent policy configuration overrides are accessible should be evaluated for this flaw.

With a CVSS score of 7.2, the flaw presents a high risk to confidentiality, integrity, and availability of the Elasticsearch data store. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the attack requires an authenticated user with Fleet management rights. An attacker controlling such a role can inject policy overrides to issue privileged API keys, giving unrestricted access to security indices. Therefore, the vulnerability is practically exploitable in environments where the Fleet feature is enabled and users are granted fleet management privileges.