Elk: Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts (CVE-2026-72666)

This vulnerability involves an authorization bypass through a user-controlled key in Kibana, enabling unauthorized query execution against Elastic Agents assigned to Kibana spaces the user does not have access to. Specifically, a user with permission to run Osquery live queries in one space can execute queries on hosts in other spaces, resulting in information disclosure via the Osquery results data stream. The root cause is functionality not properly constrained by access control lists (ACLs).

An attacker with legitimate query permissions in one Kibana space can access data from Elastic Agents in other spaces without authorization. This leads to unauthorized information disclosure from hosts outside the attacker's permitted scope. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should upgrade Kibana to version 9.4.5 or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the official fix.