CVE-2026-72668: Kibana Agent Builder Privilege Escalation

CVE-2026-72668 Overview

CVE-2026-72668 is a confused deputy vulnerability [CWE-441] in Kibana Agent Builder. A non-administrative user who can edit a shared agent can cause privileged operations to execute under the identity of a higher-privileged user who later interacts with that agent. When the same user can also author workflows, the issue extends to full administrative control of Kibana and the underlying Elasticsearch cluster. Elastic addressed the issue in Kibana 9.4.7 and 9.5.0 via security update ESA-2026-85.

Critical Impact
An authenticated low-privileged user can escalate to administrative control over Kibana and the Elasticsearch cluster by coercing a higher-privileged user to interact with a tampered shared agent.

Affected Products

Kibana versions prior to 9.4.7
Kibana 9.5.0 release line (fixed in 9.5.0)
Elastic Agent Builder feature in Kibana

Discovery Timeline

2026-09-26 - CVE-2026-72668 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-72668

Vulnerability Analysis

The flaw sits in Kibana Agent Builder, where shared agents can be edited by users with limited privileges. When a higher-privileged user later invokes the same shared agent, the agent executes actions using the invoking user's identity and permissions rather than the editor's. This mismatch between the party defining the operation and the party authorizing it is the classic confused deputy pattern described by [CWE-441].

Because Agent Builder can orchestrate privileged operations across Kibana and Elasticsearch, the editor can inject instructions that run with elevated authority once an administrator or power user interacts with the agent. Where workflow authoring is also available to the attacker, the chained capabilities allow the attacker to reach full administrative control of both Kibana and the Elasticsearch cluster. Exploitation requires user interaction from the higher-privileged victim, which aligns with the attack vector published by Elastic in advisory ESA-2026-85.

Root Cause

The root cause is improper separation between the author of an agent definition and the executor of agent actions. Kibana treats agent-defined operations as trusted intent of the current session user rather than enforcing a privilege ceiling based on the editor who last modified the shared agent.

Attack Vector

The attack vector is network-based and requires authenticated access with low privileges plus user interaction from the victim. A low-privileged user edits a shared agent to embed privileged operations, then waits for an administrator to invoke the agent. On invocation, Kibana executes the embedded operations under the administrator's identity, granting the attacker effective control of configuration, data, and cluster state.

No verified public exploit code is available at the time of writing. Refer to the Elastic Security Update ESA-2026-85 for vendor-authored technical details.

Detection Methods for CVE-2026-72668

Indicators of Compromise

Edits to shared Agent Builder definitions originating from accounts without administrative roles
Agent invocations by administrators that produce Elasticsearch API calls inconsistent with the administrator's normal activity
Creation or modification of Kibana workflows immediately following shared agent edits by low-privileged users
Unexpected role, space, or security privilege changes within Kibana audit logs

Detection Strategies

Enable Kibana audit logging and correlate saved_object write events for agent definitions with later agent execution events by different users
Alert on privilege-sensitive Elasticsearch operations (role creation, user updates, cluster settings changes) sourced from Agent Builder sessions
Baseline per-user agent authoring patterns and flag out-of-norm edits to shared agents, especially those followed by administrator interaction

Monitoring Recommendations

Forward Kibana and Elasticsearch audit logs to a centralized analytics platform for cross-user correlation
Monitor the Agent Builder APIs for unusual edit frequency on shared agents
Track administrative actions executed within short windows after shared agent edits by non-admin accounts

How to Mitigate CVE-2026-72668

Immediate Actions Required

Upgrade Kibana to version 9.4.7 or 9.5.0 as specified in advisory ESA-2026-85
Review existing shared agents in Agent Builder and remove or quarantine any created or modified by non-administrative users
Audit Kibana role assignments and remove workflow-authoring privileges from accounts that do not require them
Review recent administrator interactions with shared agents for signs of abuse

Patch Information

Elastic released fixes for CVE-2026-72668 in Kibana 9.4.7 and 9.5.0. Full remediation details are available in the Elastic Security Update ESA-2026-85. Operators should prioritize upgrading all Kibana nodes connected to production Elasticsearch clusters.

Workarounds

Restrict edit permissions on shared agents to administrative users only until patching is complete
Disable Agent Builder in environments where it is not required for business operations
Separate workflow-authoring privileges from agent-editing privileges to break the escalation chain

bash

# Verify installed Kibana version and plan upgrade
curl -sk -u "$KBN_USER:$KBN_PASS" "$KBN_URL/api/status" | jq '.version.number'

# Example: upgrade Kibana via package manager (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install --only-upgrade kibana=9.4.7
sudo systemctl restart kibana