CVE-2026-72666

Received Received - Intake

Authorization Bypass in Kibana via ACL Misconfiguration

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72666

EUVD

EUVD-2026-58267

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 9.1.0 (inc) to 9.4.4 (inc)
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-72666 is an authorization bypass vulnerability in Kibana where a user can exploit a user-controlled key to bypass access controls. This allows unauthorized execution of queries on Elastic Agents assigned to spaces the user does not have permission to access. Specifically, a user authorized to run Osquery live queries in one space can query hosts in another space, potentially exposing sensitive data.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running a vulnerable version (9.1.0 to 9.4.4). Verify if users can execute Osquery live queries across different Kibana spaces they do not have access to. Review logs for unauthorized query executions or unexpected data access patterns.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive information from hosts in restricted Kibana spaces. If exploited, attackers could retrieve data from hosts they are not permitted to access, compromising confidentiality. The impact includes potential data leaks and unauthorized information disclosure.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to protected data. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this flaw.

Mitigation Strategies

Upgrade Kibana to version 9.4.5 or later immediately. If upgrading is not possible, restrict Osquery live query permissions to specific spaces and monitor for unauthorized access attempts. Disable cross-space query execution if not required.

Hi! I’m here to help you understand CVE-2026-72666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70