Kibana CVE-2026-72680

Exploitation requires the attacker to hold a valid Kibana account with at minimum the Agent Builder read privilege - this is a low but real authentication bar (CVSS PR:L confirmed). Both the attacker and the victim must reside in the same Kibana space, as the ownership check operates within a space boundary; cross-space attacks are not indicated. The Kibana Agent Builder feature must be deployed and in active use, meaning at least one other user in the same space must have an existing conversation with a known or guessable identifier. What limits exploitation: (1) authentication is required - unauthenticated attackers cannot exploit this; (2) the attacker must know or successfully enumerate a valid conversation ID belonging to another user; (3) the attacker gains no read access to the overwritten content, reducing the incentive for data-theft-motivated adversaries; (4) the impact is confined to conversations within a single Kibana space.

The CVSS 6.5 (Medium) score is calibrated appropriately: the network-reachable, low-complexity IDOR with low-privilege exploitation is accurately reflected, and the High integrity rating captures the permanent loss of conversation ownership. However, the real-world priority depends heavily on deployment topology. Organizations running multi-user Kibana spaces with the Agent Builder feature enabled face meaningful insider-threat and privilege-abuse risk, since any user granted even minimal Agent Builder access can target colleagues in the same space. EPSS data was not included in the provided intelligence, so probabilistic exploitation rate cannot be quantified here. There is no CISA KEV listing and no public exploit code identified, both of which lower the urgency relative to a high-CVSS KEV-listed issue. The absence of confidentiality impact is a meaningful constraint - this vulnerability destroys data rather than exfiltrates it, which changes the threat model: the attacker gains nothing the victim had, making opportunistic mass-exploitation less attractive. The practical exploitation bar is raised by the requirement to know or enumerate a valid conversation ID belonging to another user in the same space, though identifiers derived from predictable or sequential patterns would lower this bar substantially. Teams should patch promptly but need not treat this as a critical emergency ahead of higher-severity, actively-exploited issues.

An attacker authenticates to a shared Kibana instance with a low-privilege account that holds only the Agent Builder read permission, then observes or guesses a conversation identifier belonging to a colleague in the same space. By issuing a crafted A2A JSON-RPC API request that references the victim's conversation ID as their own, the flawed ownership check allows the attacker's write operation to succeed, replacing the victim's conversation and transferring ownership to the attacker's account. The victim receives no notification and their entire conversation history is permanently destroyed.