Kibana CVE-2026-72658

Exploitation requires three concurrent conditions: the attacker must hold a Kibana account with at minimum the 'create visualizations' permission - no higher role is needed; a victim with a higher-privilege Kibana session (such as an administrator or operator role) must open or view a dashboard or panel that renders the malicious visualization; and the victim's browser must have an active, authenticated Kibana session at the time of rendering. The CVSS UI:R metric confirms that victim interaction - specifically navigating to and rendering the malicious visualization - is mandatory; the attack cannot succeed passively or remotely without this step. The PR:L metric confirms that attacker authentication to Kibana is required. Deployments where Kibana's Vega visualization type has been globally disabled in configuration are not exploitable via this vector. There is no network-level exploitation path independent of the victim's browser action.

The CVSS 7.3 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) reflects a meaningful but bounded threat: the attack is network-accessible and low-complexity, but is gated by two requirements - attacker possession of a low-privilege Kibana account (PR:L) and victim interaction in the form of opening a shared dashboard (UI:R). The C:H and I:H metrics are significant: a successful exploitation can result in full authenticated session abuse of the victim's Kibana context. No EPSS score was provided in the input data, so exploitation probability cannot be quantified; the absence of a CISA KEV listing and the lack of any disclosed POC suggest exploitation has not been observed at scale as of time of analysis. Despite these mitigating signals, even a mid-sized municipal IT team in inowroclaw operating a Kibana cluster for log aggregation or SIEM purposes should treat this as urgent, because the privilege escalation path requires only that any single low-privileged user be able to create visualizations - a capability commonly granted to analysts and operators. The asymmetry between the attacker's entry requirement (low-privilege account) and the potential impact (admin-level session abuse) drives real-world urgency beyond what the raw CVSS score may suggest.

An analyst account holding Kibana visualization creation rights crafts a Vega specification that issues a POST request to a Kibana role-assignment or API-key management endpoint, embedding it as a saved visualization in a shared dashboard. When a Kibana administrator opens that dashboard in their authenticated session, the browser silently executes the forged request under the administrator's credentials, potentially granting the analyst elevated role assignments or leaking session-scoped data. No public POC has been identified, but the attack pattern is well-documented under CAPEC-62 and requires no advanced tooling beyond knowledge of Kibana's REST API surface.