EUVD-2026-58254
GHSA-q63r-rpw5-hvr9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable API, low-complexity IDOR; PR:L confirmed by Agent Builder read-only requirement; A:L added because victim suffers permanent, irrecoverable loss of conversation data, which vendor's A:N understates.
Primary rating from Vendor (elastic).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.
AnalysisAI
Kibana's Agent Builder feature exposes an A2A JSON-RPC API endpoint vulnerable to Insecure Direct Object Reference (CWE-639), allowing an authenticated low-privilege user to overwrite and seize ownership of another user's conversation within the same Kibana space. The root cause is that the server-side ownership check treats a non-existent conversation ID identically to one that exists but belongs to a different user, so supplying a known identifier is sufficient to hijack it. No confidentiality breach occurs - the attacker does not read overwritten content - but the original owner suffers permanent, irrecoverable loss of their conversation history. No public exploit code has been identified and this CVE does not appear in CISA KEV at time of analysis.
Technical ContextAI
Kibana (CPE: cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is the visualization and management front-end of the Elastic Stack, and the Agent Builder is a newer AI-agent authoring capability exposed through an Agent-to-Agent (A2A) JSON-RPC API. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key), a subclass of Insecure Direct Object Reference where the application uses an attacker-influenced identifier to locate a resource and then applies an authorization check that is structurally flawed. Specifically, the ownership predicate returns the same result ('not authorized or not found') for both missing and foreign-owned conversations, so the create/replace path proceeds unchecked. The affected endpoint is reachable over the network and requires only the Agent Builder read privilege - an unusually low permission threshold for a write-capable operation - which widens the exploitable population within any multi-user Kibana deployment.
RemediationAI
Upgrade Kibana to version 9.4.5 or later per Elastic Security Advisory ESA-2026-82, available at https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-82/389535. The advisory title directly names 9.4.5 as the security update release. If immediate patching is not possible, restrict the Agent Builder read privilege to the minimum necessary set of users, since the vulnerability is only exploitable by accounts holding that privilege; removing it from untrusted or lower-trust accounts eliminates the attack surface without disabling Agent Builder for administrators. Additionally, consider enforcing strict Kibana space isolation so that untrusted users and sensitive Agent Builder conversations do not co-exist in the same space - lateral movement across spaces is not implied by the vulnerability description. Note that downgrading to remove Agent Builder entirely would be a disruptive workaround and is not recommended over patching.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today