Authorization Bypass Vulnerability in Kibana by Elastic
CVE-2026-72666

6.8MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
13 August 2026

What is CVE-2026-72666?

An authorization bypass vulnerability exists in Kibana which allows an attacker to execute unauthorized queries against Elastic Agents. This can occur when a user with access to Osquery live queries in one Kibana space is able to interact with data belonging to another space that they should not have access to. Due to improper access control list (ACL) implementations, this flaw can lead to the unauthorized disclosure of sensitive information from hosts within the restricted environment.

Affected Version(s)

Kibana 9.1.0 <= 9.4.4

References

https://discuss.elastic.co/t/kibana-9-4-5-security-update...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.