CVE-2026-72658

Received Received - Intake

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72658

EUVD

EUVD-2026-58269

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 8.19.0 (inc) to 8.19.19 (inc)
elastic	kibana	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	kibana	8.19.20
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-72658 is a Cross-Site Request Forgery (CSRF) vulnerability in Kibana. It allows a user with permission to create visualizations to craft a malicious Vega visualization. When another user opens this visualization, it executes authenticated requests in the victim's session, potentially leading to privilege escalation.

Detection Guidance

Detecting this CSRF vulnerability in Kibana requires checking the installed version against vulnerable ranges (8.19.0-8.19.19 or 9.0.0-9.4.4). Use commands like 'curl -XGET http://localhost:5601/api/status' to check the version. If Vega visualizations are enabled, inspect saved visualizations for suspicious content.

Impact Analysis

An attacker could exploit this to perform actions on behalf of authenticated users, such as modifying configurations or accessing sensitive data. This could lead to unauthorized privilege escalation or data breaches if the victim has elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if user data is compromised due to this flaw.

Mitigation Strategies

Upgrade Kibana to versions 8.19.20 or 9.4.5 immediately. If upgrading is not possible, disable Vega visualizations by setting 'vis_type_vega.enabled: false' in kibana.yml and restart Kibana. For cloud deployments, apply this setting via the Kibana user settings override in the Cloud Console.

Hi! I’m here to help you understand CVE-2026-72658. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70