Missing Authorization in Kibana Enables Unauthorized Osquery Exec
CVE-2026-72665 Published on August 13, 2026
Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.
Vulnerability Analysis
CVE-2026-72665 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-72665 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-72665
Want to know whenever a new CVE is published for Elastic Kibana? stack.watch will email you.
Affected Versions
Elastic Kibana:- Version 8.5.0, <= 8.19.19 is affected.
- Version 9.0.0, <= 9.4.4 is affected.