Privilege Escalation Vulnerability in Kibana by Elastic

CVE-2026-72658

What is CVE-2026-72658?

A Cross-Site Request Forgery vulnerability in Kibana allows an attacker to exploit the permissions of legitimate users. If an authorized user creates and saves a specifically crafted Vega visualization, any other user who opens this visualization unwittingly triggers authenticated actions in Kibana using their own session credentials. This poses significant risks as it can lead to unauthorized data access and manipulation within Kibana environments.

References