Threats tagged 'ghsa-r4ff-jqf2-8p5g'

CVE-2026-72668 is a high-severity vulnerability in Elastic Kibana versions 9.4.0 through 9.4.6 involving an unintended proxy or intermediary ('Confused Deputy') issue in the Kibana Agent Builder. This flaw allows a non-administrative user who can edit a shared agent to cause privileged operations to be executed under the identity of a higher-privileged user. If the same user can also author workflows, this can escalate to full administrative control of Kibana and the Elasticsearch cluster.