Kibana Agent Builder A2A JSON-RPC API Vulnerability Affecting Elastic

CVE-2026-72680

What is CVE-2026-72680?

The Kibana Agent Builder's A2A JSON-RPC API endpoint has a critical flaw that allows authenticated users, with only read privileges, to manipulate conversation identifiers. This oversight means users can unjustly claim ownership of conversations that belong to others, potentially leading to loss of integrity and access to conversations. As such, the rightful owners of these conversations permanently lose access to their content, affecting conversation integrity and availability without the ability for attackers to read the overwritten data.

References