CVE-2026-72669

Received Received - Intake

Kibana Observability Onboarding State Tampering Vulnerability

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72669

EUVD

EUVD-2026-58256

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	to 8.19.19 (exc)
elastic	kibana	to 9.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72669 is a security flaw in Kibana where the state for an Observability Onboarding flow is not tied to the user who created it. This allows an authenticated user with basic read access to view, modify, and tamper with another user's onboarding progress. Tampering can cause the original user's onboarding view to fail.

Detection Guidance

Check Kibana versions for affected releases (8.19.18 and below, 9.4.4 and below). Review logs for unauthorized access to Observability Onboarding flow states or tampered progress data. Look for server errors in onboarding views.

Impact Analysis

If you use Kibana versions 8.19.18 or below, or 9.4.4 and below, an attacker with access could read your onboarding progress, alter it to cause errors, or disrupt your workflow. This requires only generic read permissions in the same space.

Mitigation Strategies

Upgrade Kibana to versions 8.19.19 or 9.4.5 or later. If upgrading is not possible, restrict access to Kibana spaces and monitor for suspicious activity. No workarounds exist for unpatched versions.

Hi! I’m here to help you understand CVE-2026-72669. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70