CVE-2026-72681 — Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes…
Published: 2026-08-13 · CVSS: 6.5 · CVSS 3.1
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7