CVE-2026-72670

Received Received - Intake

Fleet Proxy Configuration Exposure via Low Privilege User

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72670

EUVD

EUVD-2026-58257

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	to 8.19.20 (exc)
elastic	kibana	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	kibana	to 9.4.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-72670 is a vulnerability in Kibana where a lower-privileged user with read access to agent policies can access sensitive Fleet proxy credentials and private key material. This occurs because the proxy configuration, which may contain authentication details, is exposed without requiring Fleet-specific privileges.

Detection Guidance

Check Kibana version using 'curl -X GET "http://localhost:5601/api/status" | grep version'. If running versions up to 8.19.19 or 9.0.0 to 9.4.4, the system is vulnerable. Verify if lower-privileged users can access agent policies and proxy configurations via Fleet UI or API endpoints.

Impact Analysis

An attacker with read access to agent policies could gain unauthorized access to proxy authentication credentials and private key material. This could lead to further network compromise, data breaches, or unauthorized access to sensitive systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Kibana to version 8.19.20 or 9.4.5 immediately. If upgrading is not possible, restrict access to agent policy configurations and Fleet proxy settings to prevent unauthorized access to sensitive credentials.

Hi! I’m here to help you understand CVE-2026-72670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70