Missing Authorization in Kibana Affects Osquery Execution and Elastic Defend Actions

CVE-2026-72665

What is CVE-2026-72665?

A vulnerability in Kibana allows users to execute Osquery and perform Elastic Defend response actions without possessing the necessary permissions. This occurs due to failure in properly constraining functionality by Access Control Lists (ACLs). Users can author and evaluate Elastic Security detection rules that enable unauthorized actions against managed agents, resulting in potential disclosure of sensitive information or unintended alterations to their configurations. The potential impact highlights the importance of stringent authorization checks to prevent misuse.

References