CVE-2026-72665 in Kibana
Summary
by MITRE • 08/13/2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical authorization bypass flaw in the Kibana security platform that stems from inadequate access control enforcement within the Elastic Security module. The issue manifests as a missing authorization check that allows malicious actors to escalate their privileges through the exploitation of improperly constrained access control lists. Specifically, users who possess the ability to create and execute detection rules can leverage this privilege to trigger response actions against managed endpoints without proper authorization. This weakness directly maps to CWE-862, which defines missing authorization as a fundamental flaw in access control mechanisms where the system fails to verify that an entity has sufficient privileges before allowing access to protected resources or functions. The vulnerability operates through CAPEC-1 patterns of accessing functionality not properly constrained by access control lists, enabling attackers to circumvent intended security boundaries.
The technical implementation of this flaw occurs within Kibana's response action framework where the system fails to validate whether the initiating user possesses the necessary permissions for specific response operations. When a detection rule is executed, the platform should verify that the user has explicit authorization for osquery live queries or elastic defend response actions before proceeding with execution against enrolled agents. However, this validation mechanism is absent or insufficiently enforced, allowing privilege escalation through rule-based triggers. The vulnerability affects the core security orchestration capabilities of Elastic Security, where response actions can include executing osquery queries on endpoints, modifying agent configurations, or triggering automated remediation processes. This creates a scenario where users with limited privileges can effectively gain access to advanced endpoint management capabilities through indirect means.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential data exfiltration and system compromise scenarios. When response actions are executed without proper authorization, attackers can potentially extract sensitive information from managed hosts through osquery queries that might reveal system configurations, running processes, network connections, or file system contents. Additionally, unauthorized changes to endpoint states could include modifying agent settings, disabling security features, or executing malicious payloads. The implications are particularly severe in enterprise environments where Kibana users may have legitimate access to detection rule creation but should not possess the ability to directly interact with endpoint systems. This vulnerability undermines the principle of least privilege and can enable attackers to maintain persistent access while evading detection mechanisms that rely on proper access controls.
Organizations should implement immediate mitigations including enhanced access control policies, regular privilege reviews, and monitoring for unusual response action patterns. The solution requires strengthening the authorization checks within Kibana's security module to ensure that all response actions undergo proper privilege validation regardless of how they are initiated. Security teams must also establish comprehensive audit trails for all response actions and implement network segmentation to limit potential lateral movement. This vulnerability highlights the importance of proper access control implementation in security platforms and aligns with ATT&CK techniques related to privilege escalation and defense evasion. Organizations should conduct thorough risk assessments to identify users with excessive privileges and ensure that detection rule creation does not inadvertently grant unauthorized system access through response action triggers. The remediation process should include patching affected versions, implementing additional authorization layers, and establishing automated monitoring for suspicious activity patterns that might indicate exploitation attempts.