Kibana CVE-2026-72681

Exploitation requires Kibana version 9.4.0-9.4.3 deployed and reachable, and an attacker-controlled account with at least low-level authenticated access to Kibana (PR:L - unauthenticated exploitation is not possible). The attacker must also have permission to use the Agent Builder feature itself, which Kibana administrators may restrict by role; if Agent Builder access is limited to fully privileged users, no privilege gap exists. Exploitation is further bounded to the narrow 9.4.x release window. What limits risk: the Agent Builder is a new component absent from all pre-9.4.0 releases, the attack is not automatable (requires manual tool construction), and organizations with homogeneous Kibana role assignments gain no attacker advantage from the escalation.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the network-accessible, low-complexity nature of the flaw requiring only authenticated access. The C:H/I:H/A:H ratings are plausible if the privilege escalation grants invocation of Kibana features that can read sensitive indices, write data, or trigger service-affecting actions - though the precise scope of reachable features is not enumerated in available data. SSVC rates Automatable as no, which is consistent with the manual workflow-construction step required in Agent Builder, limiting automated mass exploitation. EPSS at 0.25% (17th percentile) and SSVC Exploitation=none are coherent: no confirmed exploitation or public exploit code exists at time of analysis. Real-world priority is moderate-to-high specifically for multi-tenant Kibana environments where role-based data segregation is a security boundary, but organizations not on the 9.4.x branch or with uniform privilege levels face no exposure.

An authenticated Kibana user with a read-only or scoped role opens the Agent Builder, constructs a tool configured to invoke an alerting management or cross-index search feature that their role would normally block, and executes the tool. The missing authorization check allows the tool to run as if the user held the target feature's privileges, exposing sensitive data or enabling privileged actions. No public exploit code exists, so exploitation currently requires familiarity with the Agent Builder interface and knowledge of target feature API paths.