Medium severity6.8NVD Advisory· Published Aug 13, 2026· Updated Sep 2, 2026
CVE-2026-72666
CVE-2026-72666
Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- osv-coords2 versions
>= 9.1.0, < 9.4.5+ 1 more
- (no CPE)range: >= 9.1.0, < 9.4.5
- (no CPE)range: >= 9.1.0, < 9.4.5
Patches
Vulnerability mechanics
References
1- discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537nvdVendor Advisory
News mentions
1- Elastic Kibana: 25 Coordinated Vulnerabilities Expose Authorization and DoS RisksVypr Intelligence · Aug 13, 2026