Privilege Escalation in Kibana Agent Builder by Elastic
CVE-2026-72681

6.5MEDIUM

Key Information:

Vendor

Elastic
Status
Kibana
Vendor
CVE Published:
13 August 2026

What is CVE-2026-72681?

Kibana Agent Builder contains a flaw where it inadequately verifies user permissions prior to executing functionalities associated with a distinct Kibana feature. This vulnerability can potentially allow unauthorized users to gain elevated access, leading to the unwanted disclosure of sensitive information they should not have access to.

Affected Version(s)

Kibana 9.4.0 <= 9.4.3

References

https://discuss.elastic.co/t/kibana-9-4-4-security-update...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.