Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure (CVE-2026-72681)
Description
A vulnerability in Kibana Agent Builder allows privilege escalation and potential disclosure of sensitive information due to missing authorization checks. The component does not verify that the requesting user has the necessary privileges before creating and running tools that invoke other Kibana features. This affects Kibana versions from 9.4.0 up to but not including 9.4.4. A patch is available to address this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kibana Agent Builder fails to properly verify user privileges required by a separate Kibana feature before creating and executing a tool that uses that feature's functionality. This missing authorization check enables a user to escalate privileges and potentially access sensitive information they are not authorized to view. The vulnerability affects Kibana versions >=9.4.0 and <9.4.4. No CVSS score is provided, but the issue is classified as high severity. A patch is available to remediate the vulnerability.
Potential Impact
Exploitation of this vulnerability could allow an attacker with limited privileges to escalate their privileges within Kibana and access sensitive information that should be restricted. This could lead to unauthorized data disclosure and increased risk of further compromise within the affected environment.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to version 9.4.4 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-kibana-2026-72681
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-72681"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- State
- PUBLISHED
Threat ID: 6a85b4a9acd9273b4925086a
Added to database: 08/19/2026, 13:50:33 UTC
Last enriched: 09/11/2026, 09:04:53 UTC
Last updated: 10/04/2026, 10:04:19 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.