CVE-2026-72668

Executive Summary

CVE-2026-72668 is a "confused deputy" vulnerability (CWE-441) in the Kibana Agent Builder component. A non-administrative user with permission to edit a shared agent can cause privileged operations to be executed under the identity of a higher-privileged user who later interacts with that agent. Where the attacker can also author workflows, the description states this can escalate to full administrative control of Kibana and the underlying Elasticsearch cluster.

Technical Analysis

The weakness class here is CWE-441, "Unintended Proxy or Intermediary," commonly referred to as a confused deputy. In this pattern, a component holds or can obtain higher privileges than the caller, and it performs an action on behalf of the caller without adequately verifying that the caller is entitled to have that action performed. The deputy (here, the Agent Builder) is "confused" because it trusts that a request reaching it is legitimate, while the actual originator of the request is a lower-privileged user exercising indirect control over the deputy.

The NVD description identifies several structural elements of this specific instance:

• The vulnerable component is Kibana Agent Builder, a feature where agents are created and can be shared and edited.
• The attacker precondition is a non-administrative user able to edit a shared agent. This means the attacker does not need administrative privileges; they need write/edit access to an agent object that is not exclusively theirs.
• The confused-deputy effect occurs when a higher-privileged user subsequently interacts with that agent. The privileged user's identity is then used to carry out operations that the attacker caused to be scheduled or embedded within the agent.
• A second capability compounds the issue: "where the same user can also author workflows." Workflows are a separate authoring capability; when the same low-privileged user can both manipulate an agent and author workflows, the description states the outcome escalates to full administrative control of Kibana and of the Elasticsearch cluster.

The essential mechanism is therefore an authorization context substitution: the attacker's modifications to a shared agent are evaluated and executed under the privilege context of the victim who later triggers them. The vulnerability is not described as a memory-safety flaw, injection flaw, or authentication bypass; it is a logic/authorization flaw in how agents mediate actions between users of differing privilege levels.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N is consistent with this reading:

• AV:N (Network) — Kibana is a network-accessible web application.
• AC:L (Low) — the described preconditions do not require unusual conditions; edit access to a shared agent plus the victim interaction.
• PR:L (Low privileges) — an explicitly non-administrative user is sufficient.
• UI:R (User Interaction Required) — a higher-privileged user must interact with the agent; the exploit does not fire autonomously.
• S:U (Scope Unchanged) — the vulnerable component's security authority is treated as unchanged in the scoring, though the description's mention of Elasticsearch cluster impact indicates the practical blast radius can extend beyond Kibana.
• C:H / I:H (High Confidentiality, High Integrity impact) — consistent with the ability to cause privileged operations and, ultimately, cluster administrative control.
• A:N (No Availability impact) — the described effect is control-oriented, not denial of service.

No CNA title was supplied with this record, no affected version range was supplied, and no patch sources, workarounds, or vendor fix information are available from any tracked source. Specific internal function names, API paths, parameter names, and code paths are not available in the provided description and are deliberately not invented here. The analysis is therefore at the vulnerability-class and architectural level.

Exploitation Scenarios

The following chain is inferred from the CWE-441 class and the NVD description. No public proof-of-concept, Nuclei template, or exploit code is available; this is a conceptual attack chain, not a reproduced exploit.

1. Reconnaissance / target identification. The attacker needs a Kibana instance with Agent Builder enabled and at least one agent shared with or editable by their account. Reconnaissance consists of enumerating agents visible to the low-privileged account and identifying one that a higher-privileged user is likely to interact with, plus confirming whether the attacker's account also holds workflow-authoring permissions.

2. Triggering the flaw class. The attacker, using their legitimate non-administrative edit access, modifies a shared agent. Because the component is a confused deputy, the agent does not adequately distinguish "content authored by a low-privileged user" from "content that should be allowed to execute with the interacting user's privileges." The attacker's edits are therefore persisted as trusted agent behavior rather than as untrusted user data.

3. Execution method (vulnerability-class level). When the higher-privileged user subsequently interacts with the modified agent, the agent executes the attacker-influenced operations in the privileged user's security context. This is the deputy performing a privileged action on behalf of a caller who is not entitled to that action. The attacker does not need to obtain the victim's credentials; they rely on the victim's normal use of the shared agent. If the attacker can also author workflows, the description states the same confused-deputy pattern extends to workflow execution, which the description ties to full administrative control of Kibana and the Elasticsearch cluster.

4. Post-exploitation impact. Successful exploitation yields privileged operations under the victim's identity. Per the CVSS vector, confidentiality and integrity impacts are rated High, with no availability impact. In the workflow-authoring case, the described outcome is complete administrative control over Kibana and the Elasticsearch cluster — i.e., the attacker can act as a Kibana/Elasticsearch administrator without ever holding administrative credentials, and can likely establish persistence by continuing to modify agents that privileged users interact with.

It must be emphasized: because no PoC exists publicly and the advisory is sparse, the exact sequence of UI interactions, the precise payload form, and the concrete privileged operations available are not specified in the source data. Any more granular chain would be speculation.

Impact Assessment

Affected systems are Kibana deployments running Agent Builder with agent-sharing and workflow-authoring functionality, together with the Elasticsearch clusters behind them. The primary victims are higher-privileged Kibana users who interact with shared agents — their identity is the currency of the attack.

Business impact, driven directly by the CVSS subscores:

• Confidentiality: High. Privileged operations under a victim's identity can expose data the attacker's own account could not read, up to cluster-level data accessible to the compromised identity.
• Integrity: High. The attacker can cause privileged writes, configuration changes, and — in the workflow-authoring case — administrative modifications to Kibana and the Elasticsearch cluster.
• Availability: None (per vector). The described impact is not a denial of service.
• Privileges Required: Low. This is the critical business exposure: an ordinary, non-administrative user with edit rights on a shared agent is a sufficient starting position.
• User Interaction: Required. Exploitation depends on a privileged user engaging with the poisoned agent, which makes timing and social engineering a factor but also means the attack is repeatable and low-noise — a privileged user interacting with shared agents is normal business activity, not an anomaly.
• Blast radius. Directly, the affected identity; indirectly, per the description's own wording, full administrative control of Kibana and the Elasticsearch cluster. A cluster compromise can cascade to every index, snapshot, ingest pipeline, and downstream system that trusts that cluster.

The 7.3 base score with S:U may understate real-world severity in environments where the same user population handles both agent editing and workflow authoring, where the description explicitly foresees full administrative compromise.

Detection Guidance

Because this is an authorization-logic flaw rather than a memory or injection flaw, detection must focus on behavior: unusual agent modification followed by privileged agent execution, and audit-log correlation between editor identity and execution identity.

Sigma Rule

title: Kibana Agent Builder Shared Agent Modified by Non-Administrative User
id: 8d2e4a91-7c3b-4f5e-9a10-6b1c2d3e4f50
status: experimental
description: Detects modification of a shared Kibana Agent Builder agent by a user lacking administrative role, consistent with CVE-2026-72668 confused deputy privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72668
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: elastic
  service: kibana
  category: audit
detection:
  selection_event:
    event.action:
      - 'agent_update'
      - 'agent_edit'
      - 'agent_share_update'
      - 'workflow_create'
      - 'workflow_update'
  selection_nonadmin:
    user.roles|contains:
      - 'editor'
      - 'viewer'
      - 'agent_user'
  filter_admin:
    user.roles|contains: 'superuser'
  condition: selection_event and selection_nonadmin and not filter_admin
falsepositives:
  - Legitimate editors maintaining shared agents by design
  - Administrative users whose role mapping is not surfaced in event.role fields
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-72668

YARA Rule

rule CVE_2026_72668_Kibana_AgentBuilder_PrivEsc
{
    meta:
        description = "Heuristic detection of Kibana Agent Builder audit/log artifacts referencing shared-agent modification and workflow authoring, associated with CVE-2026-72668"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72668"
        cve = "CVE-2026-72668"
        cwe = "CWE-441"

    strings:
        $kb   = "kibana" ascii nocase
        $ab1  = "agent_builder" ascii nocase
        $ab2  = "agentBuilder" ascii
        $sh1  = "shared_agent" ascii nocase
        $sh2  = "sharedAgent" ascii
        $wf1  = "workflow" ascii nocase
        $ev1  = "agent_update" ascii nocase
        $ev2  = "agent_edit" ascii nocase
        $role = "role" ascii nocase

    condition:
        filesize < 5MB and
        $kb and
        ( $ab1 or $ab2 ) and
        ( $sh1 or $sh2 ) and
        ( $wf1 or $ev1 or $ev2 ) and
        $role
}

Note: no file-path or binary-artifact indicators are provided in the source data, so this rule is a heuristic content matcher against Kibana log/audit exports rather than a malware signature.

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-72668 Kibana Agent Builder shared agent modification by low-privileged user"; \
  flow:established,to_server; \
  http.method; content:"PUT"; \
  http.uri; content:"/api"; nocase; \
  http.uri; content:"agent"; nocase; \
  http.request_body; content:"shared"; nocase; \
  http.request_body; content:"workflow"; nocase; \
  threshold: type both, track by_src, count 10, seconds 60; \
  classtype:attempted-privileges; \
  sid:72668001; rev:1; \
  reference:cve,2026-72668; \
  metadata:service http; )

Note: exact Kibana API paths for Agent Builder are not available in the source data; the URI match is a broad agent keyword heuristic and should be tuned to the deployment's actual routing. The rule is intentionally low-specificity to avoid fabricated endpoint paths.

Elastic Detection

sequence by user.name with maxspan=1h
  [ any where event.category == "database" and
      event.action in ("agent_update", "agent_edit", "agent_share_update") and
      not user.roles : "superuser" ]
  [ any where event.category == "database" and
      event.action in ("agent_execute", "agent_invoke", "workflow_run") and
      user.roles : "superuser" ]

This sequence detects the core confused-deputy signature: a non-administrative identity modifies an agent, followed within a short window by execution of that agent under a privileged identity.

Splunk SPL Query

index=kibana_audit sourcetype=kibana:audit
(event.action="agent_update" OR event.action="agent_edit" OR event.action="agent_share_update" OR event.action="workflow_create" OR event.action="workflow_update" OR event.action="agent_execute" OR event.action="workflow_run")
| eval actor_role=coalesce(user.roles, roles, "unknown")
| eval is_priv=if(match(actor_role,"superuser|kibana_admin|admin"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(event.action) as actions values(actor_role) as roles by user.name, object_id
| where count > 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

For a tighter correlation, join on the modified agent object to confirm the edited agent is the one later executed by a privileged user.

Wazuh OSSEC Rule

<group name="kibana,cve-2026-72668,">
  <rule id="726680" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">agent_update|agent_edit|agent_share_update</field>
    <field name="user.roles" negate="yes">superuser</field>
    <description>CVE-2026-72668: Kibana Agent Builder shared agent modified by non-administrative user</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch version, workaround, or affected-version range is available from any tracked source. The guidance below is therefore defensive and architectural, not a vendor remediation.

1. Immediate mitigations (compensating controls, deploy now):

• Treat the agent-sharing feature as a trust boundary. Restrict creation, editing, and sharing of agents to a small, audited set of administrative users; remove Agent Builder edit permissions from non-administrative roles.
• If the same user can both edit agents and author workflows, separate those two capabilities across different roles immediately, since the description states their combination is what enables full administrative control of Kibana and Elasticsearch.
• Constrain the privilege of the identities that interact with shared agents. Where possible, ensure privileged Kibana users interact only with agents authored by equally trusted principals.
• Apply least privilege to the Kibana service account and its Elasticsearch roles; do not grant cluster-admin to any identity unless strictly required.
• Review and clean up existing shared agents: enumerate all agents, identify those edited by low-privileged users, and audit their current content before any privileged user interacts with them.

2. Patch / upgrade steps:

• No patched version is documented in any tracked source. Monitor the Elastic security advisories feed for a Kibana release addressing CVE-2026-72668 and apply it as soon as it is published.
• Until a patch exists, do not rely on version upgrades as a mitigation; rely on the compensating controls above.
• Once a fix ships, verify whether the fix is behavior-changing for existing agents (e.g., re-evaluation of agent ownership or privileges) and re-test in a staging cluster before production rollout.

3. Long-term hardening:

• Adopt an "no confused deputy" design principle for shared objects: any action executed on behalf of an interacting user must be authorized against the originating author's privileges, not the interacting user's.
• Enforce separation of duties between content-authoring roles and content-execution roles across Kibana.
• Centralize audit logging for agent edits, agent executions, workflow authoring, and privilege changes, and alert on the sequence described in the Detection Guidance section.
• Continuously monitor for exploit-in-the-wild evidence; none currently exists, and no CISA KEV listing is present, but unpatched authorization flaws in internet-facing management planes are high-value targets.
• Review Elasticsearch role mappings for any principal that could be abused to extend a Kibana-side escalation into cluster-level control.

References

• NVD — CVE-2026-72668: https://nvd.nist.gov/vuln/detail/CVE-2026-72668
• CWE-441, Unintended Proxy or Intermediary ("Confused Deputy"): https://cwe.mitre.org/data/definitions/441.html
• CVSS v3.1 Specification Document: https://www.first.org/cvss/v3.1/specification-document
• Elastic Security Advisories (monitor for CVE-2026-72668): https://www.elastic.co/community/security
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

Exploit-in-the-wild and threat actor status: No public proof-of-concept, no Nuclei template, no exploit code, and no CISA KEV entry exist for CVE-2026-72668 as of this report. No threat actor campaigns are known to be associated with this CVE. No EPSS score has been assigned by FIRST.org. The advisory record is currently unpatched with no documented workaround, making compensating access-control measures the only available defense.