Elk: Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions (CVE-2026-72665)

CVE-2026-72665 is a missing authorization vulnerability (CWE-862) in Kibana that permits unauthorized execution of Osquery and Elastic Defend response actions on enrolled hosts. Specifically, a Kibana user with the ability to author and evaluate Elastic Security detection rules can trigger response actions without possessing the required Osquery live query or Elastic Defend response action privileges. This occurs due to functionality not properly constrained by access control lists (ACLs), as described by CAPEC-1. The vulnerability affects Kibana versions >=8.5.0 <8.19.20 and >=9.0.0 <9.4.5. Exploitation can lead to unauthorized information disclosure or unauthorized changes to host state. A patch is available to remediate this issue.

Unauthorized users with detection rule authoring privileges can execute response actions on managed hosts without proper authorization. This can result in disclosure of sensitive information from the hosts or unauthorized modifications to their state, potentially compromising host integrity and confidentiality.

A patch is available for this vulnerability. Users should apply the official fix by upgrading Kibana to versions 8.19.20 or later, or 9.4.5 or later. Until patched, restrict detection rule authoring privileges to trusted users only to reduce risk.