CVE-2026-72643
Received Received - Intake

Kibana Agent Builder Ownership Validation Flaw

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72643
EUVD
EUVD-2026-58288

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
elastic elasticsearch *
elastic kibana From 9.4.0 (inc) to 9.4.4 (inc)
elastic kibana 9.5.0
elastic kibana 9.4.5
elastic kibana 9.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72643 is a vulnerability in Kibana Agent Builder where ownership of private agents is incorrectly verified. Instead of using a stable user identifier, it relies on usernames, which are not unique across different authentication realms. This allows two distinct users with the same username in separate realms to be treated as the same owner, leading to unauthorized access to agent configurations and instructions.

Detection Guidance

To detect this vulnerability, check if your Kibana version is between 9.4.0 and 9.4.4 or 9.5.0. Run the command: curl -XGET 'http://localhost:5601/api/status' and verify the version number. If it falls within the affected range, the system is vulnerable.

Impact Analysis

This vulnerability can allow an attacker to access, alter, or delete agent configurations and instructions they do not own. It may lead to unauthorized changes in Kibana environments, potentially causing data leaks or service disruptions. The impact is higher for users running affected Kibana versions (9.4.0-9.4.4 and 9.5.0).

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements such as GDPR's data protection principles or HIPAA's access controls. Organizations using affected Kibana versions may face compliance risks due to potential data breaches or unauthorized changes.

Mitigation Strategies

Upgrade Kibana to version 9.4.5 or 9.5.1 or later immediately. There are no workarounds available, so patching is required to resolve the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart