What is the CVSS score of CVE-2026-72672?

CVE-2026-72672 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Elastic Kibana are affected by CVE-2026-72672?

Elastic Kibana 8.x contains a privilege escalation vulnerability in the Elastic Security policy editor that allows authenticated users with Elastic Security feature privileges to access sensitive…

How to fix or mitigate CVE-2026-72672?

Within 24 hours, audit all Kibana users granted Elastic Security feature privileges and document their business justification. Within 7 days, enable audit logging on Kibana API access to the field suggestion endpoints, restrict Elastic Security feature privileges to only users requiring endpoint policy management, and consider network segmentation to limit Kibana-to-Elasticsearch traffic. Within 30 days, monitor Elastic advisories for patch availability and establish an upgrade timeline for all Kibana instances; in parallel, implement field-level role-based access controls in Elasticsearch to prevent unauthenticated index reads regardless of Kibana permissions.

Elastic Kibana CVE-2026-72672

EUVD-2026-58259 HIGH

Incorrect Authorization (CWE-863)

2026-08-13 elastic

GHSA-6c3r-vhrx-4vh9

Authentication Bypass Elastic Kibana

7.7

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Kibana's internal service account crosses the Elasticsearch RBAC boundary (S:C); low-privilege authentication is the only prerequisite (PR:L); confidentiality of sensitive telemetry is fully compromised (C:H); no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:52 vuln.today

CVE Published

Aug 13, 2026 - 19:11 cve.org

HIGH 7.7

DescriptionCVE.org

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.

AnalysisAI

Elastic Kibana's Elastic Security endpoint policy editor exposes sensitive Elastic Defend telemetry through a privilege escalation in the field value suggestion feature. Authenticated users holding Kibana Elastic Security feature privileges - but lacking Elasticsearch index-level read access to Elastic Defend event indices - can retrieve field values including process command line arguments, which routinely contain credentials, API tokens, and connection strings harvested from protected endpoints. No public exploit has been identified at time of analysis, but the low attack complexity and scope change across the Kibana-to-Elasticsearch authorization boundary make this straightforward to abuse by any user with a qualifying Kibana role.

Technical ContextAI

The root cause is CWE-863 (Incorrect Authorization): Kibana's internal API for the endpoint policy artifact authoring UI resolves field value autocomplete suggestions by issuing Elasticsearch queries under Kibana's own privileged internal service account rather than the requesting user's account. This bypasses Elasticsearch's RBAC model entirely - only Kibana-level feature privilege checks are performed. Elastic Defend agent telemetry (process events, network events, registry writes, etc.) is stored in Elasticsearch indices normally governed by index-level privileges; this code path circumvents those controls. The affected product is cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, indicating the issue spans all Kibana versions in scope without a lower bound specified in the CPE string.

RemediationAI

Upgrade Kibana to version 9.4.5 or later, as indicated by vendor security advisory ESA-2026-89 at https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536. As a compensating control prior to patching, restrict the Elastic Security feature privilege strictly to users who both legitimately need endpoint policy authoring capability AND are authorized to read Elastic Defend event data - this shrinks the exploitable user population but does not eliminate the authorization bypass. A second compensating option is to temporarily disable or restrict the endpoint policy artifact editor UI for non-essential users, preventing access to the triggering feature; the trade-off is reduced operational capability for policy authors. Neither workaround addresses the underlying flaw; patching to 9.4.5 is the confirmed remediation path.