CVE-2026-72666
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Kibana has an authorization bypass vulnerability through user-controlled key (CWE-639), allowing unauthorized query execution against Elastic Agents assigned to a space the user has no access to. A user authorized to run Osquery live queries in one space can have queries executed on hosts in another space, leading to information disclosure to the Osquery results data stream.
Risk Assessment
The attack can expose sensitive data from hosts in other spaces, breaking space isolation. This can lead to data leakage and compliance violations.
Recommendation
Update Kibana to the patched version. Restrict Osquery permissions and regularly audit space access.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.