High severity7.3NVD Advisory· Published Aug 13, 2026· Updated Sep 2, 2026
CVE-2026-72658
CVE-2026-72658
Description
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versions
>= 8.19.0, < 8.19.20+ 1 more
- (no CPE)range: >= 8.19.0, < 8.19.20
- (no CPE)range: >= 8.19.0, < 8.19.20
Patches
Vulnerability mechanics
References
1- discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-99/389529nvdVendor AdvisoryMitigation
News mentions
1- Elastic Kibana: 25 Coordinated Vulnerabilities Expose Authorization and DoS RisksVypr Intelligence · Aug 13, 2026