This vulnerability is an observable discrepancy (CWE‑203) in Kibana Fleet that allows an attacker to reconstruct the full Elasticsearch API key for an Elastic Agent by exploiting a side channel. The Fleet agent listing endpoint accepts filter expressions, processes them with Kibana’s internal Elasticsearch privileges, and returns the number of matching agents. By sending a short sequence of requests that vary the filter, an attacker can deduce each character of the API key with a difference in returned counts, effectively leaking the key value.

Affected: Elastic Kibana with the Fleet feature enabled. Specific versions are not listed in the CVE data, but the referenced advisory indicates updates for versions such as 8.19.x and 20.9.x. Administrators should verify whether their deployed Kibana instances include Fleet and apply the appropriate patch if available.

The CVSS score of 7.1 indicates a moderate to high impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The inference is that the attack requires access to the Kibana Fleet agent listing API, typically available to authenticated users with read permissions on agents. An attacker can send crafted filter queries from any context that can reach Kibana, using the side channel to reconstruct the API key one character at a time. Once the key is recovered, the attacker can impersonate the Elastic Agent or access data protected by that key. The vulnerability is best characterized as a remote information disclosure that could be exploited with authenticated API access.