CVE-2026-72641: Elastic Kibana Auth Bypass Vulnerability

CVE-2026-72641 Overview

CVE-2026-72641 is an Incorrect Authorization vulnerability [CWE-863] in Elastic Kibana. The flaw allows an authenticated user with only Security Solution read access in a Kibana space to enumerate and change the state of Entity Store maintainer tasks. An attacker abusing this weakness can silently disable Entity Analytics maintenance for the affected space without triggering obvious alerts. The issue affects Kibana version 9.5.0 and prior releases, and Elastic addressed it in Kibana 9.4.6 and 9.5.1.

Critical Impact
A low-privileged authenticated user can disable Entity Analytics maintenance, degrading detection coverage in Kibana Security Solution spaces.

Affected Products

Elastic Kibana 9.5.0
Elastic Kibana versions prior to 9.4.6
Elastic Kibana versions prior to 9.5.1

Discovery Timeline

2026-09-01 - CVE-2026-72641 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-72641

Vulnerability Analysis

The vulnerability resides in Kibana's Entity Store maintainer task interface within the Security Solution. Kibana authorizes task management actions using controls that do not fully validate whether the caller has write privileges. As a result, a user granted only read access to Security Solution features in a Kibana space can list and modify the state of maintainer tasks. Successful abuse disables the Entity Analytics maintenance workflow for that space, which reduces the accuracy of risk scoring, asset criticality, and related identifications that depend on the Entity Store.

Root Cause

The root cause is Incorrect Authorization [CWE-863] on the Entity Store maintainer task endpoints. Kibana treats a read-scoped Security Solution role as sufficient to interact with task-state transitions that should require write or administrative privileges. This is an instance of Accessing Functionality Not Properly Constrained by Access Control Lists [CAPEC-1].

Attack Vector

Exploitation requires network access to a Kibana instance and valid credentials for any account holding the Security Solution read privilege in the targeted space. The attacker sends authenticated HTTP requests to the Entity Store maintainer task management API to enumerate active tasks and toggle their state. No user interaction is required, and no additional exploitation primitives are needed beyond authenticated API access.

No public proof-of-concept code is available for this issue. Refer to the Elastic Kibana Security Update ESA-2026-122 for vendor technical details.

Detection Methods for CVE-2026-72641

Indicators of Compromise

Unexpected state transitions on Entity Store maintainer tasks, particularly tasks moving from enabled to disabled within a Security Solution space.
Kibana audit log entries showing task management API calls originating from accounts that hold only Security Solution read privileges.
Gaps or stalls in Entity Analytics data enrichment and risk score updates for one or more spaces.

Detection Strategies

Enable Kibana audit logging and alert on write-style operations against Entity Store or task manager endpoints performed by read-only roles.
Correlate Elasticsearch task manager activity with the effective Kibana role of the caller to surface privilege mismatches.
Baseline the expected schedule and heartbeat of Entity Store maintainer tasks and alert on unexplained disabling or pauses.

Monitoring Recommendations

Forward Kibana and Elasticsearch audit logs to a centralized analytics platform for retention and correlation.
Monitor Entity Analytics dashboards for stale data or missing entity updates that indicate maintenance has stopped.
Review role assignments in each Kibana space and flag accounts that unexpectedly interact with task management APIs.

How to Mitigate CVE-2026-72641

Immediate Actions Required

Upgrade Kibana to 9.4.6, 9.5.1, or a later fixed release as documented in ESA-2026-122.
Audit users granted Security Solution read access and remove privileges that are not required.
Verify that Entity Store maintainer tasks are running and re-enable any that were disabled without authorization.

Patch Information

Elastic released fixed builds in Kibana 9.4.6 and 9.5.1. The vendor advisory ESA-2026-122 documents the affected versions and corrective releases. Apply the patched version that matches your deployment branch.

Workarounds

Restrict Kibana network exposure so that only trusted administrators can reach the Security Solution APIs until patching is complete.
Reduce assignment of Security Solution read privileges in spaces that host active Entity Analytics workloads.
Increase audit logging verbosity and actively monitor task manager operations while the environment remains unpatched.

bash

# Verify running Kibana version and confirm it meets the fixed release
curl -s -u "$KBN_USER:$KBN_PASS" \
  -H "kbn-xsrf: true" \
  "$KIBANA_URL/api/status" | jq '.version.number'

# Expected: 9.4.6, 9.5.1, or later