CVE-2026-72681 — Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure

CVE-2026-72681

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure PUBLISHED

Description (CNA)

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.4.0 through 9.4.3

CWE

CWE-862

References

https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.