CVE-2026-72672 in Kibana
Summary
by MITRE • 08/13/2026
The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical privilege escalation and information disclosure flaw within the Elastic Security platform's endpoint policy artifact creation functionality. The issue stems from improper access control implementation where the system fails to enforce consistent authorization checks across different security layers. When users create endpoint policy artifacts, the system queries Elastic Defend event data using Kibana's internal Elasticsearch account rather than the authenticated user's credentials, creating a fundamental mismatch between feature privileges and underlying data access controls.
The technical flaw specifically manifests in the lack of proper index privilege verification during field value suggestion operations. While the system correctly validates that users possess Elastic Security feature privileges through Kibana's privilege model, it completely bypasses Elasticsearch-level index permissions checking. This oversight allows authenticated users with limited access rights to leverage the system's internal account credentials to extract sensitive information from protected indices. The vulnerability operates under CWE-284 Access Control Issues, specifically manifesting as improper access control between different security domains.
The operational impact of this vulnerability is severe and far-reaching for organizations using Elastic Security. Attackers can exploit this weakness to extract process command line arguments containing sensitive operational data including authentication tokens, connection strings, database credentials, and other confidential information that typically resides on protected hosts. This capability essentially provides unauthorized access to data that should remain restricted to privileged users with explicit index-level read permissions. The extracted information could enable further attacks, lateral movement within networks, or complete system compromise depending on the nature of the sensitive data discovered.
Organizations should implement immediate mitigations including enforcing strict index-level access controls that require users to possess both feature privileges and corresponding Elasticsearch index read permissions before accessing protected data. The system configuration should be updated to ensure that field value suggestions respect the requesting user's actual Elasticsearch privileges rather than relying solely on Kibana feature roles. Additionally, security teams should conduct comprehensive privilege audits to identify any other similar access control gaps within the platform and consider implementing more granular access controls for internal account usage. This vulnerability aligns with ATT&CK technique T1078 Valid Accounts and T1566 Phishing, as it enables attackers to escalate privileges through legitimate administrative accounts while maintaining operational security by leveraging existing platform functionality rather than introducing new attack vectors.