1. Home
  2. CVE Database
  3. CVE-2026-72681
MEDIUM · 6.5

CVE-2026-72681

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functio...

Vulnerability Description

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ElasticKibana>= 9.4.0, < 9.4.4

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2026-72681?

CVE-2026-72681 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functio...

How severe is CVE-2026-72681?

CVE-2026-72681 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-72681?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Kibana.