CVE-2026-72643

Executive Summary

CVE-2026-72643 describes an authorization bypass vulnerability in Kibana's Agent Builder component, where the ownership check for private agents is performed using an insufficiently unique identifier. When a stable user identifier is not recorded, the system falls back to comparing usernames, which are not guaranteed to be unique across different Elasticsearch authentication realms, allowing two distinct principals sharing a username to be treated as the same owner. This flaw enables an authenticated attacker to read the configuration and instructions of a private agent they do not own and potentially modify or delete that agent, with a CVSS score of 7.1 reflecting high confidentiality impact and low integrity impact.

Technical Analysis

The vulnerability resides in Kibana's Agent Builder functionality, which manages private agents and their associated configurations. The root cause is an improper authorization check (CWE-863 — Incorrect Authorization) in the ownership determination logic.

The specific mechanism is as follows:

1. Ownership Determination Logic: When a caller interacts with a private agent, the system must verify that the caller is the legitimate owner of that agent. The intended design is to compare a stable, globally unique user identifier that is recorded at agent creation time.

2. Fallback Mechanism: When the stable user identifier is not present in the agent's record (e.g., for agents created before the identifier tracking was introduced, or when the identifier fails to be captured), the system falls back to comparing the username associated with the caller against the username recorded for the agent.

3. The Flaw: Elasticsearch supports multiple authentication realms simultaneously (e.g., native realm, LDAP, Active Directory, SAML, OIDC). Usernames are only required to be unique within a single realm, not across realms. Two distinct principals in different realms (e.g., a local user "admin" and an LDAP user "admin") are entirely separate identities with potentially different privilege levels and access scopes.

4. Authorization Bypass: When a caller authenticates via a realm where a username matches the username stored on an agent owned by a different principal in a different realm, the comparison incorrectly returns a positive match. The caller is therefore treated as the legitimate owner.

Attack Surface: The attack surface is the Kibana web interface and its REST API, specifically endpoints that interact with the Agent Builder. The vulnerability requires authenticated access to Kibana, but no further privileges — the attacker only needs a valid account in any realm that shares a username with a target agent owner. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates network exploitability, low attack complexity, low privileges required, and no user interaction.

Exploitation Scenarios

Prerequisites:

• An account in any Elasticsearch authentication realm (native, LDAP, AD, SAML, etc.)
• Knowledge of at least one username in another realm that owns a private agent
• Known valid Kibana access credentials, which the attacker already possesses

Step 1 — Reconnaissance / Target Identification: The attacker identifies a target organization's Kibana instance (typically via internet-wide scanning for Kibana dashboards on ports 5601 or through proxy configurations). The attacker determines the authentication realms configured on the Elasticsearch cluster. Common username patterns (e.g., "admin", "system", "svc_agent", "monitor") are enumerated. The attacker attempts to create an account with a likely target username in a realm they control, or discovers that their existing realm contains a username collision with a target.

Step 2 — Triggering the Authorization Bypass: The attacker authenticates to Kibana using their credentials. When interacting with the Agent Builder, they call the operations for viewing, editing, or deleting an agent whose stored username matches theirs. Because the attacker's username matches the target agent's recorded username, the ownership check passes despite the principals being distinct identities in different realms.

Step 3 — Payload Methods (at the vulnerability-class level): The attack is a logic vulnerability — there is no memory corruption or injection payload. The "payload" is the crafted API request to the Agent Builder endpoint that reads, modifies, or deletes the target agent's configuration:

• Read operation: Retrieves the agent configuration and deployment instructions
• Modify operation: Submits modified configuration fields for the agent
• Delete operation: Issues a delete request for the agent

The attacker may also install a modified agent configuration that redirects data collection or exfiltration.

Step 4 — Post-Exploitation Impact: After successful exploitation:

• Confidentiality breach (C:H): The attacker obtains the full configuration and instruction set of the private agent, which may contain secrets, internal network architecture details, API keys, and system integration details.
• Integrity compromise (I:L): The attacker can alter the agent configuration to exfiltrate sensitive data, disrupt monitoring, or redirect data flows. They can also remove the agent entirely, causing a blind spot in the organization's security monitoring.
• Lateral movement: The stolen configuration may enable further access to backend systems that the agent is configured to interact with.

No public PoC is available; this attack chain is inferred from the vulnerability description and the CWE-863 class.

Impact Assessment

Business Impact:

• Confidentiality: High. Private agent configurations are treated as sensitive because they reveal deployment architecture, integration endpoints, credential material, and operational instructions. Exposure of this data to unauthorized principals within the same organization (or to external parties with valid realm credentials) constitutes a significant data leak.
• Integrity: Low-to-moderate. The attacker can alter or remove agent configurations, potentially causing service disruption, monitoring gaps, or data exfiltration paths.
• Compliance: Organizations subject to regulatory frameworks (PCI DSS, HIPAA, SOC 2) that mandate strict access control may face compliance violations. If agent configurations contain customer data endpoints or PII handling instructions, the confidentiality impact could trigger breach notification obligations.

Affected Systems: Kibana deployments using the Agent Builder feature with multiple configured authentication realms. The risk is amplified in environments where any of the following are true:

• Multiple authentication realms are concurrently active
• A history of username reuse exists across realms (common in merged organizations or after identity provider migrations)
• Agents were created before a robust user-identifier tracking mechanism was implemented

Blast Radius: Within a single Kibana deployment, the attacker gains access to all agents whose recorded usernames match their own realm-username. In a large fleet of agents managed by various teams, this could encompass agents across multiple business units. The CI/CD or data-collection infrastructure that relies on these agents is also indirectly at risk.

Detection Guidance

Sigma Rule

title: Kibana Agent Builder Unauthorized Access via Username Collision
id: 8f3a2c6d-9b1e-4f2a-8c4d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to access, modify, or delete Kibana private agents where the recorded username does not correspond to a unique principal identity, indicating a potential CVE-2026-72643 exploitation attempt.
logsource:
    category: web
    product: kibana
detection:
    selection:
        http.response.status_code: 200
        http.url.query:
            - "*agent_builder*"
            - "*agents*"
    operation:
        http.request.method:
            - POST
            - PUT
            - DELETE
    keywords:
        - "*delete*agent*"
        - "*update*agent*"
        - "*config*url*"
    condition: selection and operation
falsepositives:
    - Legitimate administrative actions by authorized users
level: medium
tags:
    - attack.t1213
    - cve.2026.72643

YARA Rule

rule CVE_2026_72643_Kibana_Agent_Owner_Check
{
    meta:
        author = "valtersit.com"
        description = "Matches strings associated with Kibana Agent Builder ownership logic vulnerability"
        cve = "CVE-2026-72643"
        date = "2026-06-01"
    strings:
        $a1 = "agent_builder"
        $a2 = "username"
        $a3 = "user_id"
        $a4 = "owner"
        $a5 = "private_agent"
        $a6 = "realm"
    condition:
        uint16(0) == 0x5A4D and 4 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72643 Kibana Agent Builder Username Collision Exploitation Attempt"; flow:to_server,established; content:"agent_builder"; http_uri; content:"agents"; http_uri; content:"username"; http_uri; reference:cve,2026-72643; classtype:attempted-user; sid:2026072643; rev:1;)

Elastic Detection

sequence with maxspan=15m
  [ network where destination.port == 5601 and
    http.request.method in ("POST", "PUT", "DELETE") and
    url.path like "*agent_builder*" ]
  [ file where file.name : "*agent*" and
    file.Ext.original.path : "*agent_config*" ]

Splunk SPL Query

index=kibana sourcetype=kibana_logs
| where like(url, "%agent_builder%") 
    AND method IN ("POST", "PUT", "DELETE")
| eval username_exists = if(isnull(username), "no", "yes")
| search username_exists="yes"
| stats count by username, src_ip, method, url
| where count > 5

Wazuh OSSEC Rule

<rule id="926333" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">agent_builder</field>
    <field name="method">POST|PUT|DELETE</field>
    <description>Potential CVE-2026-72643 exploitation attempt against Kibana Agent Builder</description>
    <group>kibana,cve_2026_72643,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, no patch, no commit, no release notes have been identified from any tracked source. Treat all Kibana versions as potentially vulnerable.

Immediate Mitigations (until a patch is available):

1. Restrict authentication realms: Audit all configured authentication realms. Where possible, consolidate to a single identity provider and enforce unique usernames across the entire identity directory.
2. Disable or restrict Agent Builder access: Implement role-based access control at the proxy level to limit who can reach Agent Builder endpoints. Use IP allowlists and VPN-only access for the Kibana web interface.
3. Enforce username namespace separation: If multiple realms are required, implement a naming convention that prevents collisions (e.g., prefix usernames with realm identifiers).
4. Monitor agent configuration changes: Enable audit logging for all Agent Builder operations. Alert on any read, modify, or delete operations performed by principals whose realm differs from the recorded realm of the agent owner.
5. Registry the workaround within IT change control: Document the risk in the enterprise risk register and require approval before any new agent is created.

Patch / Upgrade Steps:

1. Monitor Elastic's official security advisory channels daily for CVE-2026-72643 notifications — subscribe to the Elastic Security Bulletin RSS feed.
2. When a patch is released, apply it to Kibana as a priority change given the high confidentiality impact.
3. After patching, test Agent Builder ownership checks with a deliberate cross-realm username collision to verify the fix.
4. Follow the vendor's version compatibility matrix to ensure the patched Kibana works with your Elasticsearch cluster version.

Long-Term Hardening:

1. Enable robust user identifiers: After patching, ensure all existing agents are updated with their owner's stable user identifier. Run a migration script to record the realm-qualified principal (realm + username) for every agent.
2. Adopt least-privilege architecture: Review the overall Elastic stack access model. Use dedicated service accounts where agent configuration is stored. Consider network segmentation between Kibana and Elasticsearch.
3. Deploy multi-factor authentication: Require MFA for all Kibana realm authenticators to raise the bar against account takeover attacks that could compound this vulnerability.
4. Routine vulnerability scanning: Incorporate the Elastic stack into the enterprise vulnerability scanner to receive early alerts when the vendor issue is resolved.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72643 — Official CVE record with CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
2. Elastic Security Advisories: https://www.elastic.co/security — Subscribe for future patch notification; no advisory published as of report date.
3. MITRE ATT&CK — T1213: https://attack.mitre.org/techniques/T1213/ — Data from Information Repositories, the relevant tactic for this disclosure-based vulnerability.
4. CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html — The weakness class underlying the ownership-check bypass.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72643 is NOT listed; no evidence of in-the-wild exploitation.

Exploit Status: No public exploit, no Nuclei template, no Metasploit module, no evidence of in-the-wild exploitation. The vulnerability is unpatched; the risk of exploitation increases with time as security researchers and attackers analyze the public CVE description.