CVE-2026-72630

Executive Summary

CVE-2026-72630 is an Incorrect Authorization vulnerability (CWE-863) residing in the Kibana Fleet module. The flaw permits an authenticated user with the limited Elastic Defend endpoint policy management privilege to escalate their access and convert an endpoint policy into a policy for a different integration, while simultaneously supplying that integration’s configuration. This vulnerability is currently unpatched, and its exploitation can result in a high impact to confidentiality (C:H) with a low impact to integrity (I:L), as reflected in its CVSS score of 7.1 (High). Organizations leveraging Elastic Fleet for endpoint policy management are at risk of unauthorized policy modification leading to broader control over other integrations.

Technical Analysis

The core issue in CVE-2026-72630 is a flawed authorization check within Kibana’s Fleet module. Specifically, the module is designed with a role-based restriction that limits certain callers to managing integration policies for a single, specific integration. When an existing integration policy is updated, the authorization mechanism validates the caller’s privileges against the integration recorded on the stored policy rather than against the replacement integration supplied within the update request.

From a code-level perspective, this suggests that the privilege check reads the integration identifier from the persisted policy document in the database or index, rather than from the incoming request payload. An attacker who has been assigned the Elastic Defend endpoint policy management privilege can exploit this by:

1. Identifying an existing endpoint policy they are authorized to manage.
2. Crafting an update request that changes the policy’s integration type from Elastic Defend to a different, more privileged integration (e.g., a policy with broader data access or system modification capabilities).
3. Supplying the configuration parameters for that alternative integration within the same request.

Because the authorization check evaluates the old integration (Elastic Defend), it passes validation, granting the attacker the ability to overwrite the policy with the new, unauthorized integration configuration. This is a classic TOCTOU (Time-of-Check to Time-of-Use) or authorization bypass scenario, but here it is a logical flaw in the comparison between stored state and requested state.

Attack Surface:

• Entry Point: The Kibana web interface, specifically the Fleet management APIs used for updating integration policies.
• Authentication: Requires a valid user account. The attacker must possess the Elastic Defend endpoint policy management privilege. This is typically a lower-privileged role intended for managing only that specific security policy.
• Access Vector: Network-based (AV:N), requiring no user interaction (UI:N), but does require low-level privileges (PR:L).

The flaw does not require any special chaining with other bugs. It is a direct authorization bypass. The complexity is low (AC:L), indicating that the attack is straightforward once the attacker has the required baseline privilege.

Exploitation Scenarios

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance/Target Identification: An attacker with valid low-privileged credentials for a Kibana instance enumerates Fleet-managed integration policies. They specifically target the endpoint policies that they are permitted to manage (based on their Elastic Defend role). The attacker inspects the policy structure and identifies the stored integration identifier.

2. Triggering the Flaw: The attacker initiates an update to one of the endpoint policies. Instead of keeping the integration type as "Elastic Defend," they modify the request payload to change the integration field to a different, more powerful integration (e.g., "Endpoint Security" with extended permissions, or a non-security integration with access to sensitive data stores). The request must be structured so that the update action is recognized as an update to an existing policy, not a creation of a new one.

3. Payload/Execution: At the vulnerability-class level, the payload is the malicious update request containing the substitute integration configuration. Since the server-side authorization check references the stored policy’s original integration, the request is accepted. The server processes the update, replacing the policy’s configuration with the attacker-supplied data.

4. Post-Exploitation Impact: On successful exploitation, the attacker gains the ability to manage a policy for a different integration. The integrity impact is low (I:L) as the attacker can modify the policy itself. The confidentiality impact is high (C:H) because the attacker can potentially read data from or issue commands to the affected integration. The attacker could potentially use this new policy to exfiltrate data from agents associated with that integration, or alter their configuration leading to data loss or malicious activity.

Impact Assessment

Business Impact: The vulnerability allows a lateral privilege escalation within the Kibana Fleet management plane. An attacker who is trusted to manage a single security control (Elastic Defend) can expand their reach to other integrations. This could lead to unauthorized access to sensitive data collected by other integrations, or disruption of services reliant on correct integration configuration. In a worst-case scenario, an attacker could use the hijacked policy to push malicious configurations to a fleet of agents, potentially leading to widespread data compromise or operational disruption.

Affected Systems: All Kibana instances with the Fleet module enabled and with integrations such as Elastic Defend configured are potentially vulnerable. The impact is contingent on the presence of multiple integration types within the Fleet environment.

Blast Radius: The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates a scope that does not change (S:U). The direct impact is limited to the "Security" of the affected asset, but the confidentiality impact is high. This means that the attacker can gain significant access to information within the Kibana environment, although the integrity impact is low, suggesting modification of policies is limited in its direct effect on other systems.

Detection Guidance

Sigma Rule

title: Kibana Fleet - Endpoint Policy Modified to Different Integration
id: 7f9c3b8a-3d4e-4f5a-9b2c-1a2b3c4d5e6f
status: experimental
description: Detects a Kibana Fleet update request where the integration of a policy is changed from the original for an authenticated user.
logsource:
    product: elastic
    service: kibana
detection:
    selection:
        event.action: 'policy_change'
        kibana.fleet.integration: '*'
        kibana.fleet.action: 'update'
    condition: selection
level: high
falsepositives:
    - Legitimate policy migrations performed by administrators with full access
tags:
    - attack.t1548
    - cve.2026.72630

YARA Rule

rule CVE_2026_72630_Kibana_Fleet
{
    meta:
        author = "Valters IT Security"
        description = "Detects patterns in logs or memory indicating the exploitation of CVE-2026-72630"
        cve = "2026-72630"
    strings:
        $a1 = "integration_policy" ascii wide
        $a2 = "elastic_defend" ascii wide
        $a3 = "kibana_fleet" ascii wide
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72630 - Kibana Fleet Privilege Escalation Attempt"; flow:established,to_server; content:"PUT"; http_method; content:"/api/fleet"; http_uri; content:"policy"; http_uri; nocase; content:"elastic_defend"; http_client_body; offset:0; within:200; content:"integration"; http_client_body; offset:0; within:100; reference:cve,2026-72630; classtype:attempted-admin; sid:2026072630; rev:1;)

Elastic Detection

sequence by kibana.space, user.name with maxspan=10s
  [any where event.action == "policy_change" and kibana.fleet.action == "update" and kibana.fleet.integration != "elastic_defend"]
  [any where event.action == "policy_log" and kibana.fleet.integration == "elastic_defend"]

Splunk SPL Query

index=kibana event.action="policy_change" kibana.fleet.action="update" | where kibana.fleet.integration != "elastic_defend" | table _time, user.name, source_ip, kibana.fleet.policy_id, kibana.fleet.integration | sort - _time

Wazuh OSSEC Rule

<group name="kibana, fleet, cve-2026-72630,">
  <rule id="100263" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">policy_change</field>
    <field name="kibana.fleet.action">update</field>
    <field name="kibana.fleet.integration">!elastic_defend</field>
    <description>Kibana Fleet: Policy update for a different integration detected - possible CVE-2026-72630 exploitation.</description>
    <group>pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No vendor patch or official fix is available at this time.

Immediate Mitigations:

1. Restrict Privileges: Review and strictly limit the number of users with the Elastic Defend endpoint policy management privilege. Only grant this role to essential personnel.
2. Monitor Fleet Logs: Enable detailed auditing and logging for all Fleet operations, especially policy update actions. Correlate logs with the detection rules provided above.
3. Network Segmentation: Restrict network access to the Kibana instance and its APIs to only trusted administrative workstations and networks.
4. Disable Unused Integrations: If other integrations are not strictly needed, disable them in Fleet to reduce the attack surface and the potential for lateral policy modification.

Patch/Upgrade Steps:

• Check Elastic’s official security advisory page regularly for updates on this CVE. Apply patches and upgrades as soon as they are released.
• Until a patch is available, there is no official code fix to apply.

Long-Term Hardening:

1. Least Privilege Principle: Enforce the principle of least privilege across all Kibana roles and privileges. Conduct regular audits of user permissions.
2. Regular Security Reviews: Integrate periodic security reviews of Kibana configurations and custom role definitions into your maintenance schedule.
3. Web Application Firewall (WAF): Deploy a WAF in front of Kibana to inspect and potentially block suspicious API requests that attempt to alter policy integrations unexpectedly.
4. Monitor CISA KEV: Continue to monitor the CISA Known Exploited Vulnerabilities (KEV) catalog. If this CVE is added, prioritize mitigation actions, as it would indicate active exploitation in the wild.

References

1. NVD Entry for CVE-2026-72630: https://nvd.nist.gov/vuln/detail/CVE-2026-72630 (Provides official CVSS score and vulnerability description).
2. Elastic Security Advisories Page: https://www.elastic.co/security/advisories (Source for future vendor patches and advisories).
3. CAPEC-122 - Privilege Abuse: https://capec.mitre.org/data/definitions/122.html (Attack pattern classification for this vulnerability).
4. CWE-863 - Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html (Weakness classification).

Campaign Intelligence: There is no evidence of active exploitation in the wild or affiliated threat actor campaigns at the time of this report. The CVE is not listed on the CISA KEV catalog. The lack of a patch suggests a high potential for future or ongoing targeted attacks given the clear attack vector and the sensitive nature of the affected system (Elastic Fleet).