CVE-2026-72665

Executive Summary

CVE-2026-72665 is a Missing Authorization (CWE-862) vulnerability in Elastic Kibana that allows a low-privileged user to perform response actions on managed hosts without the required Osquery live query or Elastic Defend response action privileges. An authenticated Kibana user capable of authoring and evaluating Elastic Security detection rules can exploit this flaw to trigger response actions against enrolled agents, potentially resulting in disclosure of sensitive host information or unauthorized modification of host state. The vulnerability carries a CVSS score of 8.1 (High severity) with high confidentiality and integrity impact, and is currently unpatched with no vendor fix available.

Technical Analysis

CVE-2026-72665 is classified under CWE-862 (Missing Authorization), which describes a flaw where a system does not perform adequate authorization checks when a user attempts to access or perform functionality. The attack mechanism aligns with CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs), indicating that access control lists do not adequately restrict the functionality in question.

The vulnerability resides in Elastic Kibana, specifically within the Elastic Security detection rules engine. The flaw involves a privilege boundary violation between two distinct capability sets:

1. Detection rule authoring/evaluation: The ability to create and run detection rules, which is a low-privilege capability available to users with appropriate Elastic Security roles but not necessarily the elevated privileges that govern response actions.

2. Response actions: The ability to execute Osquery live queries or Elastic Defend response actions on enrolled agents, which is normally gated behind specific privileges (Osquery live query privileges and Elastic Defend response action privileges).

The vulnerability mechanism centers on insufficient authorization checks in the execution path. When a user authors and evaluates an Elastic Security detection rule, the rule evaluation engine apparently does not adequately verify that the invoking user holds the privileges normally required to execute the response actions associated with those rules. The distinction between the privileges required to author rules and the privileges required to execute response actions is not enforced during the rule evaluation process. This allows a user with rule authoring privileges — but lacking the elevated response action privileges — to trigger response actions indirectly.

From an architectural perspective, this indicates a server-side authorization failure. The Kibana backend API that processes detection rule evaluation likely validates permissions at the rule-authoring level but fails to re-validate permissions at the response-action execution level. This is a classic case of missing server-side authorization checks on a downstream action, where the system trusts that the upstream authorization is sufficient without verifying the specific capability for the nested operation.

The attack surface is the Kibana web interface and its backend APIs, accessed over the network. The vulnerability requires authentication (PR:L — Low privileges) but no user interaction (UI:N). The attack can be executed over the network without special conditions (AV:N, AC:L), and the scope is unchanged (S:U), meaning the compromised component and the affected component are the same security authority.

The technical detail available from the NVD description is limited regarding exact function names, API endpoints, or parameter names. Insufficient technical detail is available to identify the precise code path exploited. The vulnerability is described at the class level: the Elastic Security detection rule evaluation feature fails to enforce the separation of privileges between rule authoring and response action execution.

Exploitation Scenarios

No public PoC is available for CVE-2026-72665; the attack chain described below is inferred from the vulnerability class (CWE-862 — Missing Authorization) and the NVD description.

Step 1 — Reconnaissance and Target Identification

An attacker must first obtain a valid account on a Kibana instance that has Elastic Security features enabled and has agents enrolled (Elastic Agent with Osquery and/or Elastic Defend integrations). The attacker needs the ability to author and evaluate detection rules, which requires a role such as a security analyst or a custom role with detection rule authoring permissions. Target identification involves scanning for exposed Kibana instances (default port 5601) or compromising a user's credentials through phishing, password spraying, or credential theft.

Step 2 — Triggering the Flaw (Authorization Bypass)

The attacker logs into Kibana with their low-privileged account. They navigate to the Elastic Security → Rules section and create a new detection rule. During rule creation, the attacker configures the rule to include a response action — either an Osquery live query or an Elastic Defend response action. The rule can be crafted to contain a malicious or data-exfiltrating Osquery query (e.g., querying sensitive files, user credentials, environment variables) or a destructive Elastic Defend response action. The attacker then submits the rule for evaluation/execution. The vulnerability is triggered because the system does not enforce authorization checks at the response-action execution stage — the missing authorization check permits the action to proceed despite the user lacking the required privileges.

Step 3 — Payload/Execution Method

At the vulnerability-class level, the execution method is a server-side request that includes a response action specification within a detection rule. When the rule is evaluated, the Kibana backend executes the configured response action against enrolled agents via the Elastic Agent communication channel. Because authorization is only validated for rule authoring (not for the response action component), the action is dispatched to agents. The Osquery live query capability allows the attacker to execute arbitrary SQL-like queries against the host's operating system data, while Elastic Defend response actions can trigger actions such as process termination, file quarantine, or configuration changes on the endpoint.

Step 4 — Post-Exploitation Impact

Once the response action is executed on enrolled agents, the attacker can achieve:

• Confidentiality impact (High): Osquery queries can retrieve sensitive information from the host, including user account data, running processes, network connections, installed software, environment variables, and file contents. This information can be used for credential harvesting, lateral movement planning, or data theft.
• Integrity impact (High): Elastic Defend response actions can modify host state — terminating security-critical processes, quarantining files, changing endpoint protection settings, or altering system configuration — potentially weakening the host's defense posture or causing operational disruption.

The attacker does not need to hold Osquery live query privileges or Elastic Defend response action privileges, meaning this represents a privilege escalation from a low-privileged security analyst role to effectively an endpoint administrator role for response actions.

Impact Assessment

CVSS Subscore Analysis: The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) breaks down as follows:

• Attack Vector: Network — the vulnerability is exploitable remotely via the Kibana web UI/API
• Attack Complexity: Low — no special conditions or race conditions needed
• Privileges Required: Low — only a valid account with detection rule authoring capability
• User Interaction: None — no victim action required
• Scope: Unchanged
• Confidentiality Impact: High — significant host data exposure
• Integrity Impact: High — arbitrary host state modification
• Availability Impact: None — direct availability not impacted (though indirect availability impact possible via destructive response actions)

Business Impact: For organizations using Elastic Security as their SIEM/EDR platform, this vulnerability allows a compromised or malicious insider with low-level security analyst privileges to:

1. Exfiltrate sensitive data from all enrolled endpoints (PII, credentials, business-critical data)
2. Disable or degrade endpoint protections, facilitating further compromise
3. Manipulate host state across the fleet, potentially causing operational outages

Affected Systems: Any organization running Kibana with Elastic Security features enabled and Elastic Agents enrolled with Osquery or Elastic Defend integrations. The blast radius is directly proportional to the number of enrolled agents, as response actions propagate to all agents matching the rule's conditions.

Confidentiality: A malicious actor could use Osquery to enumerate sensitive data across the entire agent fleet, harvesting credentials, secrets, and sensitive system files. This information could enable broader network compromise.

Integrity: Elastic Defend response actions can modify endpoint state, allowing the attacker to weaken security controls, alter system configurations, or corrupt files across the enterprise.

Compliance: Organizations subject to regulatory requirements (PCI-DSS, HIPAA, GDPR, SOX) face audit and disclosure obligations if data exposure occurs through this pathway, alongside potential legal liability.

Detection Guidance

Sigma Rule

title: Kibana Detection Rule Response Action Without Required Privileges
id: 8e9d5f3a-6b2c-4e7d-9a1f-3c5b7d9e2f1a
status: experimental
description: Detects creation and evaluation of Elastic Security detection rules with response actions (Osquery/Elastic Defend) by users lacking the required privileges. Correlates Kibana audit logs for rule creation events with user privilege metadata.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72665
author: Valtersi Threat Intelligence
date: 2026/01/15
logsource:
    product: elastic
    service: kibana
detection:
    selection_rule_create:
        event.action: 'rule-create'  # Placeholder — actual event name may differ
        kibana.space_id: '*'
    selection_response_action:
        rule.type: 'query'  # Placeholder — actual rule type field
        rule.response_actions: '*'
    selection_privilege_context:
        user.roles: 'security_analyst'  # Placeholder — low-privilege role
    condition: selection_rule_create and selection_response_action and selection_privilege_context
    timeframe: 5m
level: high
falsepositives:
    - Legitimate security analysts creating rules with response actions (if they also hold the required privileges — correlation with privilege data needed)

YARA Rule

rule CVE_2026_72665_Kibana_Response_Action_Auth_Bypass
{
    meta:
        author = "Valtersi Threat Intelligence"
        description = "Detects Kibana detection rule JSON payloads with response actions that lack required privilege markers, indicating potential CVE-2026-72665 exploitation"
        cve = "CVE-2026-72665"
        date = "2026-01-15"
        severity = "high"
    strings:
        $s1 = "response_actions" ascii nocase
        $s2 = "osquery" ascii nocase
        $s3 = "elastic_defend" ascii nocase
        $s4 = "live_query" ascii nocase
        $s5 = "create_rule" ascii nocase
        $s6 = "detection_rules" ascii nocase
        $s7 = "privileges" ascii nocase
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B0A and
        2 of ($s1, $s2, $s3, $s4) and
        1 of ($s5, $s6) and
        #s7 < 2
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-72665 - Kibana Detection Rule w/ Response Action Auth Bypass";
    content:"POST"; http_method;
    content:"kibana"; http_host;
    content:"api"; http_uri; content:"detection_engine"; http_uri;
    content:"response_actions"; http_client_body;
    pcre:"/response_actions[\s\S]{0,500}(?:osquery|elastic_defend)/i";
    classtype:attempted-admin;
    reference:cve,2026-72665;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72665;
    sid:10072665;
    rev:1;
    metadata:created_at 2026_01_15, updated_at 2026_01_15;
)

Elastic Detection

// EQL for detecting privilege-deficient users triggering response actions
sequence by user.id with maxspan=5m
  [authentication where host.domain == "kibana" and outcome == "success" and user.roles == "security_analyst"]
  [file where event.action == "rule-create" and process.arguments contains "response_actions" and process.arguments contains ("osquery" or "elastic_defend")]

Splunk SPL Query

index=kibana sourcetype=kibana_audit
| search "response_actions" AND ("osquery" OR "elastic_defend")
| lookup privilege_lookup user_id OUTPUT user_privileges
| where NOT match(user_privileges, "osquery_live_query_privilege|elastic_defend_response_action_privilege")
| stats count min(_time) as first_seen max(_time) as last_seen by user_id, rule_name, response_action_type
| eval risk_score = case(count > 5, "HIGH", count > 2, "MEDIUM", true, "LOW")
| table first_seen, last_seen, user_id, user, rule_name, response_action_type, count, risk_score

Wazuh OSSEC Rule

<rule id="100726" level="12">
    <decoded>ossec</decoded>
    <match>response_actions|osquery|elastic_defend</match>
    <description>CVE-2026-72665: Detection rule with response action executed without elevated privileges</description>
    <group>elastic_security,kibana,authentication_failures,</group>
    <mitre>
        <id>T1554</id>
    </mitre>
    <options>no_full_log</options>
    <alert_email>soc@valtersit.com</alert_email>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, commit, or version-fixed reference exists from Elastic or any other tracked source. The vulnerability remains active with no official remediation available.

1. Immediate Mitigations (temporary, until patch is available):

• Restrict detection rule authoring: Limit the number of accounts that can author and evaluate Elastic Security detection rules. Only grant this capability to users who legitimately require it. This reduces the attack surface by minimizing the population of users who can trigger the flaw.
• Disable or restrict response actions: Where operationally feasible, disable Osquery live query and Elastic Defend response action capabilities entirely in the Elastic Security configuration until a patch is available. If this is not possible, restrict which agents are enrolled for these capabilities to minimize blast radius.
• Network segmentation: Place Kibana instances behind a VPN or bastion host, restrict inbound access by IP allowlist, and enforce MFA for all Kibana logins to reduce the risk of credential compromise leading to exploitation.
• Session monitoring: Implement enhanced auditing of all Kibana sessions, particularly detection rule creation and evaluation events, and alert on anomalous patterns.
• Least privilege enforcement: Review and reduce existing user privileges. Disable accounts of users who do not have an active operational need for detection rule authoring.

2. Patch/Upgrade Steps:

• Monitor the Elastic Security advisory page (https://discuss.elastic.co/c/security/) and the Elastic Security Announcements mailing list for patch announcements related to CVE-2026-72665.
• When a patched version of Kibana is released, upgrade Kibana instances immediately. Apply the patch to all production, staging, and development environments.
• Validate the fix in a staging environment prior to production rollout.
• After patching, verify that the authorization checks properly segregate detection rule authoring privileges from response action execution privileges.

3. Long-Term Hardening:

• Role-based access control (RBAC) audit: Regularly audit Kibana roles and privileges to ensure alignment with least privilege principles. Implement a role-review cadence (quarterly or semi-annual) to remove stale or excessive privileges.
• Defense-in-depth: Deploy additional monitoring layers around the Elastic Agent-to-Kibana communication channel. Monitor for unexpected response action execution or Osquery queries originating from Kibana sessions.
• Immutable rule templates: Where possible, implement change management controls requiring peer review for detection rule modifications, particularly for rules that include response actions.
• Runbook development: Create incident response runbooks specific to this vulnerability class (missing authorization in security platform features) to ensure quick containment if exploitation is detected.
• Capability-specific privilege monitoring: Continuously monitor the correlation between user roles and the privileges they exercise. Baseline expected privilege usage and alert on privilege boundary violations, not just on this specific CVE but on the vulnerability class generally.
• Keep the entire Elastic Stack updated: Ensure all Elastic components (Elasticsearch, Kibana, Fleet Server, Elastic Agent) are on supported versions with the latest security patches to reduce the likelihood of composite vulnerabilities.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72665
2. CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs — https://capec.mitre.org/data/definitions/1.html
3. CWE-862 — Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
4. Elastic Security Announcements — https://discuss.elastic.co/c/security/ (monitor for vendor advisory when released)
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-72665 not currently listed)

Threat Actor Campaigns/Exploit-in-the-Wild Evidence: At the time of this report, there is no evidence of active exploitation in the wild, no public PoC code, and no known threat actor campaigns targeting this vulnerability. The absence of a patch (patch confidence 0/4) combined with the high CVSS score (8.1) and network exploitability suggests this vulnerability should be treated as high-priority for defensive monitoring, with the expectation that exploitation attempts may emerge as the vulnerability becomes more widely understood.