Endpoint Policy Artifact Vulnerability in Elastic Security by Elastic

CVE-2026-72672

What is CVE-2026-72672?

An access control vulnerability in Elastic Security enables an authenticated user with specific privileges to access sensitive data from Elastic Defend event indices through Kibana. When users create endpoint policy artifacts, the system utilizes Kibana’s internal Elasticsearch account, bypassing necessary user-based privilege checks. This flaw allows users to suggest and retrieve field values, which may include sensitive information such as command line arguments, tokens, and credentials from protected hosts, potentially exposing critical operational details.

References