SB20260925250 - Multiple vulnerabilities in Kibana

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260925250

SB20260925250 - Multiple vulnerabilities in Kibana

Published: September 25, 2026

Security Bulletin ID SB20260925250
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-72668)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to an unintended proxy or intermediary ('confused deputy') in Kibana Agent Builder when a higher-privileged user interacts with an agent edited by a non-administrative user. A remote user can edit a shared agent and create workflows to escalate privileges.

A generative AI connector must be configured for Agent Builder.


2) Resource exhaustion (CVE-ID: CVE-2026-94400)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Kibana when handling requests. A remote user can cause excessive allocation to cause a denial of service.

All configurations are affected.


3) Missing Authorization (CVE-ID: CVE-2026-78582)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete Synthetics monitors in unauthorized Kibana spaces.

The vulnerability exists due to missing authorization in Kibana Synthetics monitor deletion functionality when deleting monitors shared across Kibana spaces. A remote user can delete a shared Synthetics monitor from a space they can access to delete it from spaces they cannot access.

When the monitor is associated with a private location, deleting it also destroys the underlying Elastic Agent integration configuration. Exploitation requires Kibana spaces to be in use and monitors to be shared across more than one space.


4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-72662)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose, modify, or delete data.

The vulnerability exists due to authorization bypass through a user-controlled key in the Security Solution Timeline feature when accessing draft Timeline objects in the same Kibana space. A remote user can enumerate, read, modify, or delete draft Timeline objects belonging to other users to disclose, modify, or delete data.

Read access is sufficient for enumeration and disclosure, while the Timeline write privilege is required for modification and deletion.


Remediation

Install update from vendor's website.

References