Elk: Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions (CVE-2026-72664)

CVE-2026-72664 is a missing authorization vulnerability (CWE-862) in Kibana that permits users who only have detection rule authoring privileges within the Elastic Security solution to associate automated endpoint response actions with detection rules. These users can cause Elastic Defend response actions to be executed on managed hosts without possessing the dedicated endpoint response action privileges that normally control such capabilities (including host isolation, process operations, and execute operations). When detection rules authored by these users generate alerts, the unauthorized response actions are carried out against the matching hosts. This vulnerability affects Kibana versions >=8.9.0 <8.19.20 and >=9.0.0 <9.4.5. A patch is available to remediate this issue.

Unauthorized Kibana users with limited privileges can trigger endpoint response actions on managed hosts, potentially leading to unintended or malicious host isolation, process manipulation, or execution of operations. This could disrupt endpoint operations or be leveraged to interfere with host security controls. However, exploitation requires the user to have detection rule authoring privileges, limiting the scope of impact.

A patch is available for this vulnerability. Users should apply the official fix by upgrading Kibana to versions 8.19.20 or later, or 9.4.5 or later, as appropriate. Until patched, restrict detection rule authoring privileges to trusted users only to reduce risk.