CVE-2026-72681CWE-862broken-access-control

CVE-2026-72681

Medium · published August 14, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00438 · 37.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-14T00:17Z
Affected products (1)
ProductVersionsFixed in
elastic/kibana≥ 9.4.0, < 9.4.49.4.4
References (1)
https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534 · [email protected]
EPSS history
Timeline
  • 13 AUG 19:11Z
    Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
    cvelistv5