CVE-2026-72668 — HIGH (7.3)

Vulnerability Description

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

CVSS Score

7.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Related Weaknesses (CWE)

CWE-441

References

https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/3906

FAQ

What is CVE-2026-72668?

CVE-2026-72668 is a vulnerability with a CVSS score of 7.3 (HIGH). Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged op...

How severe is CVE-2026-72668?

CVE-2026-72668 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-72668?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.