Elastic Kibana CVE-2026-72670

Exploitation requires a valid, authenticated Kibana user account with at minimum the 'read agent policies' Fleet privilege - a permission commonly granted to analysts and operators who do not hold full Fleet administrative access. The Fleet proxy feature must be actively configured with a proxy server; if no proxy is configured, there is no sensitive credential material to expose, though the authorization bypass itself still exists. Exploitation is strictly limited by the requirement for prior authentication: unauthenticated network access is insufficient to exploit this vulnerability. The CVSS PR:L metric confirms the low-privilege requirement. The S:C scope change in the CVSS vector indicates that impact extends to systems protected by the exposed proxy credentials, beyond the Kibana instance itself.

The CVSS 7.7 score with a Scope Changed (S:C) vector reflects that exploitation could harm systems beyond Kibana itself - specifically the proxy infrastructure and downstream systems reachable through compromised credentials. Attack Vector is Network with Low Complexity and Low Privileges required, meaning any authenticated user with minimal Fleet access can exploit this remotely without special conditions. No EPSS score was provided in the input data, so exploitation probability cannot be quantified with precision; however, the low privilege barrier and purely network-accessible exploitation path suggest non-trivial real-world risk, and even a mid-sized municipal IT team in kielce running Kibana as a SIEM platform should treat credential exposure as urgent given that compromised proxy credentials could pivot to monitored network traffic or adjacent services. This vulnerability has not been added to the CISA KEV catalog and no public exploit code is identified at time of analysis, which moderates urgency somewhat. The SSVC technical impact is Total on confidentiality given private key exposure, but exploitation has not been confirmed as automated or widespread.

An attacker with a low-privileged Kibana account - for example, a security analyst role granted only 'read agent policies' access to review Fleet policy definitions - sends an authenticated request to the Fleet proxy configuration API endpoint. The endpoint returns the full proxy configuration, including authentication credentials and private key material, without enforcing the required 'Fleet read settings' privilege check. The attacker extracts these credentials and uses them to authenticate to the proxy infrastructure or impersonate Kibana to intercept proxied traffic.