MEDIUM 6.8 NVD

CVE-2026-72666

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kiba

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

References

https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537

Published: 2026-08-13 · Source: NVD · Feed updated: 2026-08-13

This medium severity vulnerability with a CVSS score of 6.8 was published on 2026-08-13 via NVD.

vulnfeed aggregates 10812 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.