Kibana Agent Builder CVE-2026-72643

Exploitation requires: (1) the target Kibana deployment must be configured with two or more Elasticsearch authentication realms (e.g., a native realm and an LDAP/Active Directory realm operating simultaneously); (2) the attacker and victim must share an identical username string in their respective realms; (3) the attacker must hold a valid low-privilege authenticated session in Kibana (PR:L per CVSS vector). Exploitation is limited to the Kibana Agent Builder feature - it does not affect other Kibana capabilities or Elasticsearch data. Single-realm deployments are not affected. The fallback to username comparison also requires that no stable user identifier was recorded for the target agent, which may occur depending on how the agent was originally created or how realm metadata is captured. No user interaction from the victim is required once the realm overlap condition exists.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) scores 7.1, indicating a high-severity, network-reachable flaw requiring only low-privilege authentication with no user interaction or special complexity from the attacker's perspective. However, the real-world exploitability is bounded by a specific deployment condition: the Elasticsearch cluster must be configured with multiple authentication realms AND two distinct principals must share the same username string across those realms. In large enterprises using LDAP/AD realms alongside native Kibana realms this scenario is plausible and not uncommon, making this more than a theoretical concern. EPSS data is not available in the provided intelligence; no CISA KEV listing confirms active exploitation. The SSVC signals suggest: exploitation not confirmed in the wild, attack is not fully automatable without the realm overlap precondition, and technical impact is partial - confidentiality of agent instructions is fully compromised (C:H) but system integrity impact is limited to the Agent Builder resource (I:L). The gap between C:H in CVSS and the bounded real-world risk due to the realm-overlap prerequisite is notable - defenders in single-realm deployments are not affected.

An attacker who is a legitimate low-privilege Kibana user authenticated via an LDAP realm targets a victim user in the native Elasticsearch realm who happens to share the same username string. Because the victim's agent was created without recording a stable user identifier - or because the fallback path is triggered - the attacker sends a standard Kibana Agent Builder API request; the ownership check resolves the attacker's username as equivalent to the victim's, returning the victim's private agent configuration and instructions without error. No public exploit code has been identified, but the attack requires only standard authenticated HTTP requests to the Kibana API.