Incorrect authorization in Kibana - CVE-2026-72672
Published: August 13, 2026
Vulnerability identifier: #VU142334
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72672
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to incorrect authorization in the Elastic Security field value suggestion capability when querying existing field values while authoring endpoint policy artifacts. A remote user can retrieve field values from Elastic Defend event data to disclose sensitive information.
The issue occurs because Kibana uses its internal Elasticsearch account for these queries and does not verify the caller's Elasticsearch index privileges.
Affected software
Kibana
How to mitigate CVE-2026-72672
Install security update from vendor's website.
Kibana - update to 9.4.5