The vulnerability arises because Kibana Agent Builder uses a stable user identifier when available to verify ownership of a private agent, but falls back to comparing usernames when such an identifier is not recorded. Since usernames can be duplicated across different Elasticsearch authentication realms, two distinct principals with the same username in different realms are incorrectly treated as the same owner. This leads to unauthorized disclosure of agent configuration and instructions, and permits alteration or removal of agents by unauthorized callers.

An attacker with low privileges can gain unauthorized access to the configuration and instructions of agents they do not own. They can also alter or remove these agents, potentially disrupting operations or causing data integrity issues. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users of affected versions 9.4.0 and 9.5.0 should monitor Elastic's advisories for updates and consider restricting access to Kibana Agent Builder functionality until a fix is available.