CVE-2026-72670 in Kibana
Summary
by MITRE • 08/13/2026
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical privilege escalation issue within fleet management systems where users with minimal read access to agent policies can bypass intended security controls to access sensitive proxy configuration data. The flaw stems from improper access control implementation where the system fails to properly enforce authorization boundaries between different levels of administrative privileges. A user possessing only basic agent policy reading permissions can exploit this weakness to retrieve comprehensive proxy settings that typically require elevated Fleet privileges for access. This represents a clear violation of the principle of least privilege and demonstrates inadequate separation of concerns in the system's permission model.
The technical nature of this vulnerability falls under the category of insufficient access control as classified by CWE-284, where the system fails to properly restrict access to sensitive resources based on user permissions. The flaw allows for unauthorized data exposure through a privilege escalation vector that should not exist within properly designed security architectures. The proxy configuration data likely contains critical authentication credentials including username/password combinations or API keys that provide access to downstream systems. Additionally, private key material may be exposed which could enable attackers to establish unauthorized connections or impersonate legitimate system components. This type of information disclosure creates significant risk for organizations relying on secure communication channels and encrypted connections.
The operational impact of this vulnerability extends beyond simple information leakage to encompass potential compromise of entire network infrastructure. Attackers who exploit this weakness can gain access to authentication credentials that may provide access to multiple downstream systems or services that rely on the proxy configuration for connectivity. The exposure of private key material could enable man-in-the-middle attacks, certificate forgery, or unauthorized access to protected resources that depend on the secure proxy connections. This vulnerability also enables attackers to understand the complete architecture of proxy implementations and potentially identify additional attack vectors through knowledge of proxy configurations and authentication mechanisms.
Organizations should implement immediate mitigations including strengthening access control policies to ensure proper privilege enforcement between different administrative roles. The system configuration should be reviewed to establish clear boundaries between agent policy reading permissions and proxy configuration access rights. Regular security audits should validate that access controls are properly enforced and that users cannot escalate privileges through indirect means. Additional protective measures include implementing role-based access control with explicit authorization checks for sensitive configuration data, monitoring access patterns for unusual privilege usage, and ensuring that authentication credentials are stored securely using proper encryption mechanisms. This vulnerability aligns with attack techniques documented in the MITRE ATT&CK framework under privilege escalation and credential access categories, specifically targeting the exploitation of weak access controls to gain unauthorized system access.