Elastic Kibana CVE-2026-72672

Exploitation requires an authenticated Kibana session with at minimum the Elastic Security feature privilege (PR:L per CVSS vector) - unauthenticated access is not possible. The specific triggering mechanism is the field value autocomplete/suggestion API within the endpoint policy artifact authoring UI; the attacker must navigate to and interact with this specific editor component. The target environment must have Elastic Defend deployed and actively generating endpoint telemetry in the Elasticsearch cluster - without populated event indices there is no sensitive data to retrieve. No additional user interaction beyond the attacker's own browser session is required (UI:N). Exploitation is limited by the requirement for a valid Kibana account with an Elastic Security feature role; an organization that assigns this role only to users who also hold the corresponding Elasticsearch index read privileges effectively has no exploitable privilege gap.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, score 7.7 High) accurately captures the core risk: low attack complexity, only low-privilege authentication required, and a scope change reflecting that Kibana's internal service account crosses into an Elasticsearch security domain the caller is not authorized to access. The C:H rating is justified because process command line telemetry is a high-value target - secrets managers, CI pipelines, and database clients routinely expose credentials in argv. No KEV listing is present in the input and no EPSS data was provided, so exploitation probability cannot be quantified numerically; exploitation sophistication is low once a qualifying Kibana account is in hand. There is no integrity or availability dimension. The CPE wildcard does not specify a minimum affected version, and the exact floor should be confirmed against the vendor advisory before scoping remediation effort.

An attacker with a valid Kibana account assigned the Elastic Security feature role - but no Elasticsearch index privileges on Elastic Defend event indices - opens the endpoint policy artifact editor and triggers field value suggestions on fields such as process.args or process.command_line. Kibana silently proxies these queries through its internal service account, returning matching telemetry values directly to the attacker's browser session. The attacker extracts credentials, API keys, or database connection strings from the returned suggestions without any direct Elasticsearch access or elevated Kibana role.