CVE-2026-72650

Received Received - Intake

Authorization Bypass in Kibana Leads to Information Disclosure

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72650

EUVD

EUVD-2026-58275

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	kibana	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	kibana	8.19.20
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-72650 is an authorization bypass vulnerability in Kibana that allows authenticated users to access telemetry data from unauthorized spaces. The flaw occurs because user-controlled keys are not properly validated, enabling users with read access to alerting rules in one space to retrieve execution telemetry from other spaces they should not be able to access. This includes sensitive details like rule identifiers, names, space identifiers, execution outcomes, timestamps, and counters.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running a vulnerable version (8.0.0 through 8.19.19 or 9.0.0 through 9.4.4). Verify if unauthorized users can access alerting rule telemetry across spaces they are not permitted to view.

Impact Analysis

This vulnerability could allow an attacker with legitimate access to one Kibana space to view telemetry data from other spaces they are not authorized to access. This may lead to unauthorized disclosure of sensitive operational information, such as which alerting rules are running, their execution status, and performance metrics across different environments.

Compliance Impact

This vulnerability could potentially violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data. Exposure of telemetry information might reveal details about system operations or configurations that could be considered confidential under these regulations, leading to non-compliance risks if exploited.

Mitigation Strategies

Upgrade Kibana to a patched version (8.19.20 or 9.4.5 or later) immediately. If upgrading is not possible, restrict access to alerting rule telemetry and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-72650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70