CVE-2026-72664 in Kibana
Summary
by MITRE • 08/13/2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution can associate automated endpoint response actions with a detection rule, even though the dedicated Endpoint response action privileges that govern those capabilities (host isolation, process operations, and execute operations) have not been granted to that user. When such a rule generates alerts, the associated response actions are carried out against the matching hosts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical authorization flaw in the Elastic Security solution within Kibana that enables privilege escalation through improper access control mechanisms. The issue stems from CWE-862, which specifically addresses missing authorization checks where the system fails to verify that users have proper permissions before granting access to protected functionality. In this case, Kibana's access control list implementation does not properly constrain user privileges when associating automated response actions with detection rules, creating a pathway for unauthorized execution of critical endpoint operations.
The technical flaw manifests when a user with limited detection rule authoring capabilities attempts to configure automated response actions within Elastic Defend. These users can successfully associate endpoint response actions such as host isolation, process operations, and execute operations with their detection rules, despite lacking the explicit privileges required to perform these functions. This occurs because the system does not validate whether the user possesses the necessary authorization levels for the specific response actions they are attempting to configure, effectively bypassing the intended security boundaries that separate different privilege levels.
The operational impact of this vulnerability is severe and potentially devastating for organizations relying on Elastic Security for endpoint protection. An attacker with detection rule authoring privileges could craft malicious detection rules that automatically execute destructive operations against managed hosts when alerts are triggered. This includes isolating critical systems from network access, executing arbitrary commands on endpoints, or performing process manipulation that could lead to system compromise, data exfiltration, or service disruption. The vulnerability essentially allows a user with minimal security clearance to gain significant operational control over endpoint devices through the configuration of automated response actions.
Organizations should implement immediate mitigations including strict enforcement of privilege separation between detection rule authors and users requiring endpoint response capabilities. The system configuration must be reviewed to ensure that only authorized administrators can associate response actions with detection rules, and that proper access control lists are enforced for all automated endpoint operations. Additionally, implementing comprehensive audit logging of rule modifications and response action executions will help detect unauthorized attempts to exploit this vulnerability.
This vulnerability aligns with ATT&CK technique T1059 which involves executing commands through automated systems, and specifically relates to the privilege escalation patterns described in CAPEC-1 where functionality is accessed without proper authorization constraints. The flaw demonstrates a classic case of insufficient authorization checking that can be exploited by attackers to elevate their privileges beyond what was originally intended for their user roles.
Organizations should also consider implementing role-based access control enforcement that validates all user actions against the principle of least privilege, ensuring that users cannot configure automated response actions without explicit authorization for those specific operations. Regular security assessments and privilege reviews should be conducted to identify similar authorization gaps in other security tools that may present comparable risks.