What is the CVSS score of CVE-2026-72670?

CVE-2026-72670 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Elastic Kibana are affected by CVE-2026-72670?

Kibana's Fleet module exposes sensitive proxy credentials and private key material to under-privileged users through broken access controls.

How to fix or mitigate CVE-2026-72670?

Within 24 hours, audit 'read agent policies' permission holders and immediately rotate all proxy credentials currently exposed through Fleet. Within 7 days, restrict this permission to administrative users only, enable comprehensive audit logging for Fleet access, and implement network segmentation around proxy infrastructure. Within 30 days, monitor Elastic advisory channels for patch availability and stage testing in non-production environments.

Elastic Kibana CVE-2026-72670

EUVD-2026-58257 MEDIUM

Information Exposure (CWE-200)

2026-08-13 elastic

GHSA-gh7x-jm44-9v5r

Information Disclosure Elastic Kibana

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (elastic) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-exploitable with low privilege required; scope changed because proxy credentials impact infrastructure beyond Kibana; confidentiality impact only, no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Sep 04, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Sep 04, 2026 - 20:22 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 19:51 vuln.today

CVE Published

Aug 13, 2026 - 19:11 cve.org

HIGH 7.7

DescriptionNVD

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

AnalysisAI

Broken object-level authorization in Elastic Kibana's Fleet module exposes sensitive proxy configuration data to under-privileged users who should not have access to it. A user holding only the 'read agent policies' permission - a scope far narrower than Fleet administrative access - can read the full Fleet proxy configuration, including proxy authentication credentials and private key material. No public exploit code has been identified at time of analysis, but the CVSS Scope Changed metric (S:C) reflects that stolen credentials could be leveraged against proxy infrastructure well beyond the Kibana instance itself.

Technical ContextAI

Kibana's Fleet module is Elastic's centralized agent management interface, used to configure and manage Elastic Agents across distributed infrastructure. Fleet proxy configurations store outbound proxy settings, which frequently include proxy authentication credentials (username and password) and TLS private key material used to authenticate the Kibana server to the proxy. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the authorization enforcement on the Fleet proxy configuration read path fails to distinguish between the 'read agent policies' privilege and the separately required 'Fleet read settings' privilege. Affected products are identified via CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, indicating broad version impact across the Kibana product line. Fixed versions per Elastic's advisory ESA-2026-87 are 8.19.20 and 9.4.5.

RemediationAI

The primary remediation is to upgrade Kibana to version 8.19.20 for 8.x deployments or 9.4.5 for 9.x deployments, as confirmed in Elastic's security advisory ESA-2026-87 at https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524. Until patching is feasible, administrators should audit Kibana role assignments and remove the 'read agent policies' privilege from any users who do not strictly require it, accepting the trade-off of reduced operational visibility for those accounts. Where a Fleet proxy is configured with authentication credentials or private key material, rotating those secrets immediately is advisable as a precautionary measure, since prior exposure cannot be confirmed or ruled out without deploying the patch. For environments that do not rely on a Fleet proxy, deconfiguring the proxy setting reduces the sensitive data footprint, though the authorization bypass itself persists until the patch is applied.