CVE-2026-72666

Executive Summary

CVE-2026-72666 is an authorization bypass vulnerability (CWE-639 — Authorization Bypass Through User-Controlled Key) affecting Elastic Kibana. The flaw permits a user authorized to execute Osquery live queries in one Kibana space to target Elastic Agents assigned to a different space to which the requesting user has no access. Successful exploitation results in the unauthorized query being executed against hosts belonging to another space, with query results written to the Osquery results data stream — effectively disclosing sensitive information from those hosts to the attacker. The vulnerability is currently assessed as UNPATCHED, with no patch evidence from any tracked source and a CVSS score of 6.8 (High) due to the confidentiality and integrity impact combined with the authenticity of the attack vector (user-triggered, not fully unauthenticated).

Technical Analysis

The vulnerability class is CWE-639 (Authorization Bypass Through User-Controlled Key). In this class of flaw, the application relies on a user-supplied identifier (a "key") to authorize access to a resource without sufficiently validating that the requesting principal has legitimate access rights to that resource. In the context of Kibana's Osquery integration, multi-tenancy is enforced at the level of Kibana spaces — each space isolates dashboards, saved objects, and the associated Elastic Agents assigned to that space. A user with permissions to run Osquery live queries within Space A can manipulate the identity (key) of the target resource — in this case, the Elastic Agent or its associated space identifier — to select an agent belonging to Space B.

The NVD description explicitly attributes the exploitation to "Accessing Functionality Not Properly Constrained by ACLs" (CAPEC-1), which describes an attack where a user invokes a function that should have been gated by an access control check but was not. In this case, the authorization check that should have constrained which agents can be queried based on space membership is either absent or improperly implemented, allowing the user-controlled agent selection to bypass the space-based isolation.

The attack surface is the Kibana web application and its backend API that orchestrates Osquery live queries against registered Elastic Agents. No specific API endpoint names, request parameters, or internal function names are provided in the NVD description, and we will not fabricate them. The mechanism is fundamentally a missing or insufficient authorization check on the target selection step of a live query request.

Note: The vulnerability is currently UNPATCHED. No affected version range has been disclosed by the vendor, and the CNA has not yet published an advisory with a specific patch version. This limits the precision of any version-based detection or remediation guidance. Insufficient technical detail is available to map the exact code path or to identify the specific request structure that triggers the flaw.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC is available, and no exploit code has been released.

Step 1 — Reconnaissance / target identification. The attacker is an authenticated Kibana user in at least one space (Space A) where they hold the Osquery Live Queries privilege. The attacker enumerates registered Elastic Agents visible in their space and identifies that the Osquery API accepts agent selection parameters. The attacker must also determine (or guess) the names or IDs of agents belonging to a target space (Space B) to which they have no access. This could be achieved via information leakage, shared agent naming conventions, or brute-forcing agent IDs.

Step 2 — Triggering the flaw. The attacker issues an Osquery live query request from the Kibana UI or through its backend API. Instead of selecting an agent from Space A, the attacker supplies the identifier (key) of an agent assigned to Space B. The vulnerability manifests when the backend fails to validate that the requesting user has the space:read or all privilege for the space to which the target agent belongs. The user-controlled agent key is trusted without a cross-check against the user's effective space permissions.

Step 3 — Payload / execution. At the vulnerability-class level, the attacker submits a valid Osquery SQL query (for example, a SELECT statement over system metadata tables) targeted at the Space B agent. Because the authorization check is bypassed, the query is relayed to the target Elastic Agent, which executes it. The attacker may use standard, legitimate Osquery SQL syntax to extract system information — no malicious payload is required beyond the unauthorized targeting. No specific SQL syntax is provided in the NVD description; the query content is limited only by the permissions already granted to the attacker in their own space.

Step 4 — Post-exploitation impact. The query results are written to the Osquery results data stream (a system index named logs-osquery_manager.result-* in standard Elastic deployments), which the attacker can then read via Kibana Discover or through the results API — even though the hosts queried belong to Space B. The confidentiality impact is High (C in CVSS): the attacker can read arbitrary file paths, environment variables, running processes, network connections, and other host telemetry from machines outside their authorized scope. The integrity impact is also rated High due to the CVSS vector (I:H), reflecting the ability to run arbitrary queries (subject to Osquery SQL limitations) on those hosts, potentially including write operations such as reading and exfiltrating data in unauthorized ways. The attack requires no user interaction, but does require low privileges (an authenticated lower-privileged user) and high attack complexity (AC:H), indicating that the attacker must have some knowledge of the target agent identifiers and must be authenticated.

Availability is not impacted (A:N). The attack is network-based (AV:N) but requires the request to pass through the Kibana server, making the complexity high primarily due to the need to discover valid agent keys across space boundaries.

Impact Assessment

Business Impact. Multi-tenant or departmentally partitioned Elastic deployments are at direct risk. In enterprises where Kibana spaces are used to isolate business units, regulatory compliance boundaries, or client environments, this vulnerability collapses those boundaries at the host telemetry level. An attacker who has low-level access in one space can silently extract host-level data — including file contents, process lists, environment variables (which may contain API keys or service account credentials), and network configuration — from any host whose Elastic Agent is registered in any other space of the same cluster. This represents a cross-tenant data breach of the most sensitive telemetry class.

Affected Systems. All Kibana deployments with the Osquery integration enabled and more than one Kibana space configured are potentially affected. The vulnerability is especially critical in environments where Elastic Agents are distributed across clear security boundaries (e.g., separate offices, subsidiaries, or client-managed fleets). Since no affected version range is published, all currently supported Kibana versions should be considered at risk until the vendor releases a patch.

Blast Radius. The CVSS base score is 6.8 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. The key takeaways from the sub-scores are:

• Confidentiality: High — full host telemetry disclosure across space boundaries.
• Integrity: High — the attacker can run arbitrary Osquery commands on unauthorized hosts, which can modify system state (e.g., via UPDATE/DELETE operations supported by some Osquery tables like file, users, or custom multi-table queries, subject to Osquery capabilities).
• Availability: not impacted.
• Privileges Required: Low — a standard Kibana space user is sufficient.
• Attack Complexity: High — the attacker must obtain valid agent identifiers for the target space, which is not trivially discoverable in all configurations.
• Scope: Unchanged — the privilege escalation stays within the same security authority (the Kibana application and the Elastic cluster).
• Exploitability in the wild: No exploit code has been published and CISA has not added this to the KEV catalog. However, once details are confirmed, exploitation is plausible given the ease of reproducing missing ACL checks.

If exploited at scale, a single low-privileged user could pivot into a full host compromise chain: extraction of credentials from environment variables, discovery of internal network topology, and lateral movement — all while operating "legitimately" within the Osquery framework, which may evade traditional EDR detections because the queries are performed by the agent under active management.

Detection Guidance

The following detection rules target the observable footprints of this vulnerability exploitation: anomalous cross-space Osquery activity, excessive result reads, and unusual query patterns. Because no public PoC is available, these rules model the expected behavior of the attack chain.

Sigma Rule

title: CVE-2026-72666 - Cross-Space Osquery Live Query Execution
id: 92b5a1c8-4e71-4f9e-8a6d-3a2f6d0c19b2
status: experimental
description: Detects a Kibana user executing Osquery live queries against Elastic Agents assigned to a different Kibana space than the requesting user's authorized space. This pattern is indicative of CVE-2026-72666 authorization bypass.
author: Valtersit Threat Intelligence
date: 2026/08/01
logsource:
    product: elastic
    service: kibana
detection:
    selection_osquery:
        event.dataset: "kibana.audit"
        event.action: "osquery.live_query_execute"
    selection_cross_space:
        # "space" is the space the requesting user is authorized in;
        # "agent_space" is the space to which the target agent is assigned.
        space: "*"
        agent_space: "*"
    condition: selection_osquery and selection_cross_space and not (space == agent_space)
falsepositives:
    - Admin users with cross-space access privileges (must be filtered by role).
    - Misconfigured single-space deployments where agent_space is NULL.
level: high
tags:
    - attack.tactic:credential_access
    - attack.technique:T1552
    - cve.2026.72666
    - cwe.639

YARA Rule

rule CVE_2026_72666_Kibana_Osquery_Cross_Space
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Kibana API requests that attempt to execute Osquery live queries with agent identifiers spanning multiple Kibana spaces. Targets HTTP request bodies and audit logs."
        date = "2026-08-01"
        references = "CVE-2026-72666"
        cve = "2026-72666"
        cwe = "639"
        severity = "high"
    strings:
        $osquery_endpoint = "osquery" ascii nocase
        $live_query = "live_query" ascii nocase
        $space_param = "space" ascii nocase
        $agent_id = "agent_id" ascii nocase
        $result_datastream = "logs-osquery_manager.result" ascii nocase
        $cross_space_hint = "space_id" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or uint16(0) == 0x000A or
        uint16(0) == 0x000D or uint16(0) == 0x3C21 or
        (uint16(0) == 0x7B7B or uint16(0) == 0x5B7B) // JSON or array-like
        and 3 of them
        and (#osquery_endpoint > 0 and #live_query > 0)
        and (#space_param > 0 and #agent_id > 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72666 - Kibana Osquery Cross-Space Request"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; nocase; content:"osquery"; http_uri; nocase; content:"live"; http_uri; nocase; content:"agent"; http_uri; nocase; pcre:"/space[^\"]*\"[^\"]*\"/i"; pcre:"/agent[^\"]*\"[^\"]*\"/i"; reference:cve,2026-72666; classtype:attempted-user; sid:202672666; rev:1;)

Elastic Detection

sequence by user.id, host.ip with maxspan=5m
  [ any where event.module == "kibana" and event.action == "osquery.live_query_execute"
    and kibana.space.name != "" ]
  [ any where event.dataset == "osquery.manager.result" and event.module == "osquery"
    and kibana.space.name != "" and kibana.space.name != source.space.name ]

Splunk SPL Query

index=elasticsearch sourcetype=kibana_audit action="osquery.live_query_execute" 
    | eval authorized_space=space, target_agent_space=agent_space 
    | where authorized_space != target_agent_space 
    | table _time, user.id, user.name, url.path, agent.id, authorized_space, target_agent_space
    | stats count by user.name, target_agent_space
    | where count > 3

Wazuh OSSEC Rule

<rule id="100266" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.dataset">kibana.audit</field>
    <field name="event.action">osquery.live_query_execute</field>
    <field name="user.id">\.+</field>
    <field name="space">\.+</field>
    <field name="agent_space">\.+</field>
    <description>CVE-2026-72666 - Cross-space Osquery live query detected for user $(user.name) targeting agent in space $(agent_space) while authorized in space $(space).</description>
    <group>osquery,kibana,access_control,</group>
    <mitre>
        <id>T1552</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence has been identified from any tracked source as of this writing. The vendor (Elastic) has not published a fixed version, a workaround advisory, or a hotfix. Administrators should monitor the Elastic Security advisory page and the Kibana release notes for a security patch.

1) Immediate mitigations (until a patch is available):

• Disable the Osquery live query feature in Kibana spaces settings if it is not business-critical. This can be done by removing the Osquery Live Queries privilege from all non-administrative roles and by setting xpack.osquery.enabled: false in kibana.yml (requires a Kibana restart).
• Restrict agent visibility: Configure Elastic Agent output to limit agent discovery to the same space — use the xpack.fleet.agents.privileges settings or enforce that agents are only visible in the space where they are enrolled.
• Harden authentication: Enforce MFA for all Kibana users. While this does not prevent the bypass, it raises the barrier for initial access.
• Segregate clusters: For highly sensitive tenants, deploy separate Elasticsearch clusters with wholly separate fleets, rather than relying on space-level isolation.
• Review audit logs (see Detection Guidance above) for any evidence of cross-space query activity that may already have occurred.

2) Patch / upgrade steps: No patch is currently available. Once Elastic releases a fixed version, the following steps apply:

• Update Kibana to the patched version listed in the advisory.
• Test in a non-production environment, validating that Osquery live queries still work for authorized users and that cross-space access is denied.
• Roll out progressively to production, prioritizing clusters with multi-tenant space configurations.
• After patching, rotate any credentials that may have been exposed via Osquery result data streams if exploitation is suspected.

3) Long-term hardening:

• Adopt the principle of least privilege: grant Osquery Live Queries only to users with a clear operational need.
• Enable and retain Kibana audit logs for at least 12 months.
• Use a centralized SIEM rule (e.g., the Sigma rule above) to monitor for cross-space Osquery activity on an ongoing basis, not just during the incident window.
• Consider an Osquery policy that restricts allowed SQL query types (e.g., disable UPDATE/DELETE tables) at the agent configuration level to limit integrity damage if a bypass recurs.
• Prospectively review all Kibana plugins and integrations that accept user-controlled resource identifiers for the same class of authorization bypass; this bug class is frequently repeated across features.

References

1. NVD Entry for CVE-2026-72666 — https://nvd.nist.gov/vuln/detail/CVE-2026-72666
2. CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs — https://capec.mitre.org/data/definitions/1.html
3. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
4. Elastic Security Advisories (for future patch announcements) — https://www.elastic.co/community/security
5. Osquery Manager Documentation (for context on live query architecture) — https://www.elastic.co/guide/en/kibana/current/osquery.html

Known threat actor campaigns / exploit-in-the-wild evidence: No public exploit code, PoC, or in-the-wild exploitation has been reported for CVE-2026-72666 as of the writing of this report. CISA has not listed this CVE in its Known Exploited Vulnerabilities catalog. The vulnerability remains unpatched, and thus any observed exploitation attempts in Kibana logs should be treated as highly suspicious and immediately escalated.