CVE-2026-72672

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.

• CWE-863

• https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536Vendor Advisory

Published

Aug 13, 2026

Last Modified

Sep 4, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72666Authorization Bypass Through User-Controlled Key (CWE-639) i…6.8
• CVE-2026-72667Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-72669The state that Kibana stores for an Observability Onboarding…7.6
• CVE-2026-7267A flaw has been found in SourceCodester Pizzafy Ecommerce Sy…6.3
• CVE-2026-72670A lower privileged user who holds only the privilege to read…6.5
• CVE-2026-72671A Kibana Machine Learning capability that removes a saved ob…4.3
• CVE-2026-72673Incorrect Authorization (CWE-863) in Kibana can lead to unau…5.4
• CVE-2026-72674Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-72675Missing Authorization (CWE-862) in Kibana can lead to cross-…7.1
• CVE-2026-72676Improper Control of Generation of Code ('Code Injection') (C…9.1
• CVE-2026-72677Relative Path Traversal (CWE-23) in Kibana can lead to the u…7.3
• CVE-2026-72678Elasticsearch does not validate a size value taken from a us…6.5