Elastic Kibana: Four Vulnerabilities Disclosed, Including Privilege Escalation and DoS

Key findings

• Four vulnerabilities in Elastic Kibana disclosed on September 26, 2026, including one High and three Medium severity flaws.
• CVE-2026-94400: Uncontrolled Resource Consumption leading to potential Denial of Service.
• CVE-2026-78582: Missing Authorization allows deletion of shared Synthetics monitors by privileged users.
• CVE-2026-72668: 'Confused Deputy' vulnerability in Agent Builder enables privilege escalation for non-admins.
• CVE-2026-72662: Authorization Bypass via user-controlled key permits unauthorized data access and modification.
• Patches are available; users are urged to update Kibana promptly.

On September 26, 2026, a batch of four vulnerabilities was disclosed for Elastic's Kibana, with three of the four rated as Medium severity and one as High. These vulnerabilities, detailed in a single advisory, span across resource consumption, authorization bypass, and privilege escalation. The disclosures highlight potential risks including denial of service, unauthorized data deletion, and the ability for non-administrative users to perform privileged operations.

One of the disclosed vulnerabilities, CVE-2026-94400, is an Uncontrolled Resource Consumption flaw. This vulnerability can lead to a denial of service condition through excessive memory allocation.

CVE-2026-78582 addresses a Missing Authorization issue. An authenticated user with specific Synthetics privileges within a Kibana space could exploit this to permanently delete shared Synthetics monitors, resulting in significant data loss.

A more critical vulnerability, CVE-2026-72668, falls under the 'Confused Deputy' or Unintended Proxy category. This flaw in the Kibana Agent Builder could allow a non-administrative user to escalate their privileges. By editing a shared agent, they could trick a higher-privileged user into executing sensitive operations under their own identity.

Finally, CVE-2026-72662 involves an Authorization Bypass Through User-Controlled Key. This vulnerability permits authenticated users with the Timeline feature privilege to access functionality not properly constrained by Access Control Lists (ACLs). This could lead to unauthorized viewing, modification, or deletion of data.

Elastic has addressed these vulnerabilities. Users are advised to update to the latest versions of Kibana to mitigate these risks. The timely disclosure and patching of these issues are crucial for maintaining the security and integrity of data managed through the Kibana platform.

The collective impact of these vulnerabilities underscores the importance of robust authorization checks and resource management in complex platforms like Kibana. Users should ensure their Kibana instances are updated promptly to prevent potential exploitation.