CVE-2026-72668

HighCVSS 7.3/10Last modified Sep 29, 2026

Description

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-441

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 26, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-726697.6The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read an CVE-2026-72676.3A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This mani CVE-2026-726706.5A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. T CVE-2026-726714.3A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target,CVE-2026-726727.7The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend ev CVE-2026-726735.4Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality No CVE-2026-726746.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130 CVE-2026-726757.1Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Ab CVE-2026-726769.1Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script con CVE-2026-726777.3Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139)CVE-2026-726786.5Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal da CVE-2026-726796.5Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling