The vulnerability is improper privilege management (CWE-269) in Kibana Fleet. When an integration policy declares additional data streams, Fleet expands the Elasticsearch API key issued to agents in that policy. The enlarged key permits the agent to insert documents and modify index mappings for those streams, but not to read, update, or delete existing documents. An attacker who can create or alter such policies can therefore obtain a key with privileges beyond the intended scope, enabling a privilege‑escalation scenario.

Elastic Kibana appliances that use the Fleet integration are affected. Although the description does not list specific releases, any systems running older, unsupported Kibana versions or those that employ default Fleet agent policies without appropriate data‑stream restrictions remain vulnerable.

With a CVSS base score of 6.5, the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain. Likely attack vectors involve an attacker leveraging the Kibana management UI or API to add or modify integration policies, which requires at least a Kibana user with policy‑creation privileges. Once the over‑scoped key is issued, the attacker can insert data and extend index mappings, compromising the integrity of the indexed data and potentially enabling further attacks.