High severity7.3NVD Advisory· Published Aug 13, 2026· Updated Aug 13, 2026

CVE-2026-72658

Description

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Kibanallm-fuzzy

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529nvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000