CVE-2026-72633: Kibana Entity Analytics Auth Bypass Flaw

CVE-2026-72633 Overview

CVE-2026-72633 is an Incorrect Authorization vulnerability [CWE-863] in Kibana Entity Analytics. An authenticated user with only read-level Security feature access, and no Elasticsearch privileges, can stop the recurring Privilege Monitoring engine task for a Kibana space. Once stopped, privileged user monitoring silently ceases producing data for that space. The Privilege Monitoring engine continues reporting a healthy state to operators, hiding the loss of visibility.

Elastic addressed the issue in Kibana 9.4.6 and 9.5.2 through security update ESA-2026-130.

Critical Impact
A low-privileged authenticated user can disable privileged user monitoring in a Kibana space while the engine falsely reports healthy status, creating a blind spot for security operations teams.

Affected Products

Kibana versions prior to 9.4.6
Kibana versions prior to 9.5.2
Elastic Entity Analytics Privilege Monitoring engine

Discovery Timeline

2026-09-01 - CVE-2026-72633 published to NVD
2026-09-01 - Last updated in NVD database
2026-09-01 - Elastic publishes security update ESA-2026-130

Technical Details for CVE-2026-72633

Vulnerability Analysis

The vulnerability resides in the authorization logic of the Kibana Entity Analytics Privilege Monitoring engine. The engine exposes an administrative action that stops the recurring background task responsible for collecting privileged user activity. Kibana does not enforce sufficient permission checks before honoring that request.

An attacker holding only read-level Security feature access can invoke the task-stop path. No Elasticsearch cluster or index privileges are required. After the task is stopped, no privileged user telemetry is written for the affected Kibana space. Operators querying engine health receive a healthy response, so the outage is not surfaced through normal monitoring channels.

The impact is limited to loss of security monitoring integrity. Data is not exfiltrated, and system availability outside the monitoring pipeline is not affected. The gap creates opportunity for follow-on attacks against privileged accounts to go undetected within the space.

Root Cause

The root cause is a missing authorization check on the Privilege Monitoring engine's task-management endpoint. The handler validates that the caller is authenticated and holds any Security feature access, but does not require write-level privileges or an equivalent administrative role before permitting the task to be stopped.

Attack Vector

Exploitation requires network access to Kibana and valid credentials for any account with read-level Security feature access. No user interaction and no elevated Elasticsearch privileges are needed. The attacker issues an authenticated request to the Privilege Monitoring engine's control interface to halt the recurring task for a target Kibana space. See ESA-2026-130 for vendor technical detail.

Detection Methods for CVE-2026-72633

Indicators of Compromise

Unexpected stop events for the Privilege Monitoring engine task in Kibana audit logs
Sudden absence of privileged user monitoring documents in the Entity Analytics indices for a given Kibana space
Authenticated Kibana API calls to Privilege Monitoring task-management endpoints from accounts holding only read-level Security access
Divergence between reported engine health (healthy) and actual data ingestion volume

Detection Strategies

Enable Kibana audit logging and alert on any invocation of Privilege Monitoring engine task-control operations.
Correlate engine health status with ingestion metrics; alert when the engine reports healthy but new document counts drop to zero.
Baseline expected privileged monitoring document volume per Kibana space and alert on statistically significant drops.

Monitoring Recommendations

Forward Kibana audit and application logs to a centralized SIEM for retention and correlation.
Track which Kibana user roles invoke Entity Analytics administrative endpoints and flag calls from non-administrator roles.
Review Kibana role assignments regularly to confirm that only intended users hold Security feature access, even at read level.

How to Mitigate CVE-2026-72633

Immediate Actions Required

Upgrade Kibana to version 9.4.6, 9.5.2, or later as published in ESA-2026-130.
Audit current Kibana role assignments and remove Security feature access from users who do not require it.
Verify the Privilege Monitoring engine is running and producing data in every Kibana space after patching.

Patch Information

Elastic released fixed versions Kibana 9.4.6 and 9.5.2. The patch corrects the authorization check on the Privilege Monitoring engine task-control path so that stopping the recurring task requires appropriate administrative privileges. Refer to the Elastic Security Update ESA-2026-130 for full advisory details.

Workarounds

Restrict Security feature access in Kibana to trusted administrators until the upgrade is applied.
Monitor Privilege Monitoring engine document ingestion per space and treat sustained zero-ingestion as an incident, regardless of reported engine health.
Place network controls in front of Kibana to limit administrative API exposure to trusted management networks.

bash

# Verify installed Kibana version meets the fix
curl -s -u "$KBN_USER:$KBN_PASS" "$KBN_URL/api/status" | jq '.version.number'

# Expected output: 9.4.6, 9.5.2, or later