CVE-2026-72672

Executive Summary

CVE-2026-72672 is an authorization bypass vulnerability in Elastic Kibana's Elastic Security endpoint policy authoring feature. When a user authors endpoint policy artifacts and the system suggests existing field values, the feature queries Elastic Defend event data using Kibana's internal Elasticsearch service account rather than the requesting user's account. This flaw allows an authenticated user with Elastic Security feature privileges — but no read access to Elastic Defend event indices — to retrieve sensitive field values, including process command-line arguments that frequently contain credentials, tokens, and connection strings from protected hosts.

The vulnerability carries a CVSS score of 7.7 (High) with a scope change, indicating that the compromised component (Kibana) impacts resources beyond its security boundary (Elasticsearch data). The attack requires low-privilege authentication, no user interaction, and no special conditions. The EPSS score of 0.00248 indicates low current exploitation likelihood. No CISA KEV listing, no public PoC, and no known exploit code have been identified at the time of writing. Patch availability is claimed by a single source (NVD) but has not been independently confirmed by vendor advisories.

Technical Analysis

The vulnerability resides in a server-side authorization enforcement failure within Kibana's Elastic Security module. Specifically, the feature responsible for auto-suggesting field values during endpoint policy artifact authoring does not enforce the caller's Elasticsearch index-level privileges.

Vulnerability Mechanism:

The root cause is improper access control — categorized as CWE-863 (Incorrect Authorization). The system validates only Kibana feature-level privileges (e.g., whether the user has access to the Elastic Security application), but fails to propagate or enforce the user's Elasticsearch index privileges when performing backend queries against Elastic Defend event data.

Under normal operation, when a user interacts with data in Kibana, the application should:

1. Authenticate the user to Kibana.
2. Verify the user's Kibana feature privileges.
3. Execute Elasticsearch queries using the user's credentials or an impersonation mechanism that respects the user's index-level permissions.

In this vulnerable implementation, step 3 is flawed: the query against Elastic Defend event indices is executed with Kibana's internal Elasticsearch account (a highly privileged service account). This means that even if a user has no read privilege on the .logs-endpoint.* or related Elastic Defend indices, the backend service account bypasses that restriction and returns data to the requesting user.

Technical Detail (as described):

The NVD description specifies that the flaw triggers "while a user authors endpoint policy artifacts." The suggestion engine that offers existing field values queries Elastic Defend event data. Since only Kibana feature privileges are verified — not Elasticsearch index privileges — the authorization boundary is crossed.

Attack Surface:

• Authentication Required: Yes — the attacker must be an authenticated Kibana user with Elastic Security feature privileges.
• Network Vector: The attack is conducted over the network (CVSS AV:N).
• Complexity: Low (CVSS AC:L) — no special conditions or race conditions are required.
• Privileges Required: Low (CVSS PR:L) — a standard authenticated user account with the Elastic Security Kibana feature role suffices.
• User Interaction: None (CVSS UI:N) — the attack does not require phishing or tricking another user.

Data at Risk:

The specific data exposed is Elastic Defend event field values. Critically, this includes process command-line argument fields. Command-line arguments routinely contain:

• API tokens and access keys
• Database connection strings and passwords (e.g., in command options like --password or -Ddb.password=)
• Cloud provider service account credentials
• Configuration secrets passed during process execution
• Environment-specific operational details

These events originate from hosts protected by Elastic Defend (endpoint agent), meaning the leaked data reveals internal host activity, software stack details, and potentially lateral movement artifacts to an unauthorized threat actor.

Missing Technical Details:

The NVD description does not specify the exact Kibana API endpoint, internal service account name, affected version ranges, or the precise feature module responsible. Insufficient technical detail is available to map the affected code path. The affected version range is listed as empty, and the vendor has not yet published an advisory with version-specific patch details.

Exploitation Scenarios

Attack Chain Inference:

Note: No public PoC or exploit code exists for CVE-2026-72672. The attack chain below is inferred strictly from the vulnerability class (CWE-863 — Incorrect Authorization) and the NVD description. No specific implementation details, function names, or API endpoints are fabricated.

Step 1 — Reconnaissance / Target Identification:

An attacker begins by identifying an exposed Kibana instance. Kibana is typically accessible via HTTP/HTTPS on port 5601, often exposed to internal corporate networks and sometimes inadvertently to the internet behind a reverse proxy. Shodan-style search queries (e.g., product:"Kibana" or http.title:"Kibana") can identify internet-facing deployments. The attacker also needs to determine whether the target organization uses Elastic Security and Elastic Defend for endpoint protection — internet-accessible instances, job listings, or public documentation can confirm this.

Step 2 — Authentication and Feature Access:

The attacker must have (or obtain) valid credentials for a low-privileged Kibana user account. This could be achieved via:

• Credential stuffing using previously leaked corporate credentials.
• Phishing a legitimate low-privilege user.
• Exploiting a separate vulnerability to obtain credentials.
• Insider threat scenarios where a disgruntled or compromised employee already holds such an account.

Critically, the attacker needs only the Elastic Security Kibana feature privilege — not any Elasticsearch index read permission on the Elastic Defend event indices. Many organizations grant broad Kibana feature access to analysts or IT staff while restricting raw index access; those users are all viable vectors.

Step 3 — Triggering the Vulnerability:

Once authenticated, the attacker navigates to the Elastic Security endpoint policy authoring interface. During the authoring of endpoint policy artifacts, the attacker interacts with the field-value suggestion/autocomplete feature. By triggering the suggestion mechanism (e.g., typing in a field input to receive value suggestions), the backend queries Elastic Defend event data using Kibana's internal service account. The attacker does not need to know the underlying index names or Elasticsearch query syntax — the UI handles the interaction.

The attacker may iteratively probe various fields to maximize data extraction. Fields such as process command-line (process.command_line), process arguments, and other operational fields will return values harvested from actual Elastic Defend events.

Step 4 — Post-Exploitation / Data Exfiltration:

The attacker extracts returned field values. Because the suggestion endpoint returns aggregated/unique values from event data, the attacker can systematically enumerate values for fields of interest. Process command-line values are particularly valuable:

• The attacker harvests tokens, credentials, connection strings, and internal operational detail.
• Collected secrets may enable lateral movement into protected hosts.
• Credentials may grant access to cloud consoles, CI/CD systems, or other corporate infrastructure.
• Connection strings reveal database endpoints and application architecture.

Because this is an information disclosure (not code execution), the attacker's post-exploitation activity focuses on credential reuse and further intrusion leveraging the harvested material.

Additional Scenario — Batch Enumeration:

A patient attacker may script UI interactions (via Kibana's API if the underlying suggestion endpoint is directly callable) to systematically harvest values across many fields and time ranges. The lack of index-level access control means the exposure is bounded only by what data exists in the Elastic Defend indices and what the suggestion feature exposes.

Impact Assessment

CVSS Breakdown: The 7.7 CVSS score (High severity) reflects the following subscores:

• Attack Vector: Network (AV:N) — exploitable remotely over the network.
• Attack Complexity: Low (AC:L) — no special preconditions or race conditions.
• Privileges Required: Low (PR:L) — minimal authenticated privileges needed.
• User Interaction: None (UI:N) — no victim involvement.
• Scope: Changed (S:C) — the vulnerability in Kibana impacts Elasticsearch's protected data resources.
• Confidentiality Impact: High (C:H) — significant unauthorized disclosure.
• Integrity Impact: None (I:N) — no data modification possible.
• Availability Impact: None (A:N) — no denial of service.

Business Impact:

1. Credential Exposure: Process command-line arguments routinely contain secrets. Exposure of these credentials to unauthorized users creates a direct path to additional compromise of protected hosts and connected systems.

2. Regulatory / Compliance: Organizations subject to PCI-DSS, HIPAA, or GDPR may face compliance violations if operational data containing personal or payment information is exposed through this channel.

3. Trust Boundary Violation: The vulnerability violates the defense-in-depth principle. Even organizations that correctly restrict index-level access to sensitive Elastic Defend data are exposed because Kibana's service account bypasses those protections.

4. Blast Radius: The Scope:Changed component indicates the impact crosses component boundaries. Any host running Elastic Defend whose events are ingested into the cluster has its process execution data exposed. In large deployments, this spans thousands of endpoints.

Affected Systems: Any Kibana deployment with the Elastic Security feature enabled and Elastic Defend endpoint event data ingested. The feature is commonly used in enterprise environments with mature endpoint protection programs.

Exploitation Likelihood: EPSS 0.00248 (16th percentile) indicates low current active exploitation. The lack of public PoC, exploit code, and CISA KEV listing further suggests this is not yet weaponized in the wild. However, the low attack complexity and the high value of exposed data make weaponization likely once the technical details become public.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-72672 Exploitation - Unauthorized Elasticsearch Query from Kibana
status: experimental
description: Detects Elasticsearch queries executed by Kibana's internal service account targeting Elastic Defend indices without corresponding user index-level authorization. Correlates with the authorization-bypass pattern described in CVE-2026-72672.
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    product: elasticsearch
    service: audit
detection:
    selection_kibana_user:
        user.name: "kibana"  # Kibana internal service account (adjust based on deployment)
    selection_endpoint_indices:
        index: 
            - ".logs-endpoint*"
            - "logs-endpoint*"
            - ".siem-signals*"
    selection_suggestion_operation:
        event.action: "search"
        event.category: "database"
    condition: selection_kibana_user and selection_endpoint_indices and selection_suggestion_operation
level: high
falsepositives:
    - Legitimate Kibana background operations (e.g., security solution features querying endpoint data for dashboards)
    - Investigation: review whether the originating session corresponds to a legitimate user with Elastic Security privileges and verify session context
fields:
    - user.name
    - source.ip
    - kibana.saved_object.id
    - process.command_line
tags:
    - cve.2026-72672
    - attack.t1552
    - attack.t1005  # Data from Local System

YARA Rule

rule cve_2026_72672_kibana_authz_bypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects potentially malicious Kibana scripts or harvested data patterns associated with CVE-2026-72672 authorization bypass. Targets extracted credential/command-line data from Elastic Defend indices."
        date = "2026-01-01"
        cve = "CVE-2026-72672"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72672"
    strings:
        $a1 = ".logs-endpoint" ascii wide nocase
        $a2 = "process.command_line" ascii wide nocase
        $a3 = ".siem-signals" ascii wide nocase
        $b1 = "connectionString" ascii wide nocase
        $b2 = "password=" ascii wide nocase
        $b3 = "token=" ascii wide nocase
        $b4 = "api_key" ascii wide nocase
        $b5 = "mongodb://" ascii wide nocase
        $c1 = "fieldValueSuggestions" ascii wide nocase
        $c2 = "endpointPolicy" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and  // PE header (script compiled)
        (2 of ($a*) and 1 of ($b*)) or
        (1 of ($c*) and 2 of ($b*))
}

Note: YARA alone will not reliably detect exploitation of this server-side flaw since it occurs in memory/backend logic. This rule targets malicious scripts, exfiltration tooling, or harvested data repositories containing strings indicative of Elastic Defend index queries combined with credential-like content.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72672 - Potential Kibana Elastic Defend Data Exfiltration via Unauthorized Query"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; http.uri; content:"suggest"; nocase; http.uri; content:"endpoint"; nocase; http.uri; content:"policy"; nocase; http.uri; content:"fieldValue"; nocase; pcre:"/\/api\/[^\"]*(suggest|fieldValue|endpoint|policy)[^\"]*/i"; sid:20267201; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-72672, tag t1552, tag t1005;)

Note: This rule detects HTTP requests containing URI patterns consistent with Kibana API calls to the field-suggestion/autocomplete feature. Since the NVD description does not provide exact endpoint paths, this rule applies network-level heuristics. The rule should be tuned against legitimate Kibana traffic to reduce false positives (Kibana dashboard requests may include similar patterns). This detection layer is best used to identify anomalous volumes of suggestion requests from a single user.

Elastic Detection

// EQL detection for CVE-2026-72672 exploitation pattern in Elasticsearch audit logs
// Detects the access pattern where Kibana service account queries Elastic Defend indices
// under conditions consistent with the authorization bypass.

sequence by host.name, user.name with maxspan=30s
  [authentication where event.action == "login" and
     user.name == "kibana-system" and
     source.ip != "127.0.0.1"]
  [audit where event.action == "search" and
     indexes like "%.logs-endpoint%" and
     indexes like "%.siem-signals%" and
     kibana.session_id != null]

Note: Written as Elastic EQL targeting Elasticsearch audit log events. Deployment specifics (internal account naming, session tracking fields) must be adjusted to match the organization's indexes and field naming conventions. Use the index patterns logs-elastic.audit-* or the endpoint security audit index if configured.

Splunk SPL Query

index=elasticsearch_audit OR index=endpoint_security_audit sourcetype=elasticsearch:audit
| where like(index, "%.logs-endpoint%") AND user.name="kibana"
| stats count by _time, user.name, source.ip, index, kibana_session_id
| where count > 50
| table _time, user.name, source.ip, index, count, kibana_session_id
| sort - count

Alternatively — broader detection hunting for unusual Kibana service account access to sensitive indices:

index=* sourcetype=elasticsearch:audit action=search
| search index=".logs-endpoint*" user.name="kibana"
| eval alert_trigger=if(isnotnull(kibana_session_id), "Session-based access", "Unsolicited access")
| table _time, user.name, source.ip, index, action, alert_trigger, event_data
| where NOT (sourcetype LIKE "kibana%background%" AND alert_trigger="Session-based access")

Wazuh OSSEC Rule

<group name="elasticsearch, attack, cve_2026_72672,">

  <rule id="439522" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">^search$</field>
    <field name="user.name">^kibana$|^kibana-system$|^elastic$</field>
    <field name="index">\.logs-endpoint</field>
    <description>CVE-2026-72672: Kibana internal account queried Elastic Defend endpoint index - potential unauthorized data access</description>
    <group>cve_2026_72672,elastic_security,information_disclosure,</group>
    <mitre>
      <id>T1552</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="439523" level="8">
    <if_sid>10072672</if_sid>
    <field name="user.name">^kibana$</field>
    <description>CVE-2026-72672: Repeated Kibana service account queries against endpoint indices - investigate session context</description>
    <group>cve_2026_72672,</group>
    <options>no_full_log</options>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The NVD lists a patch as available, but no vendor advisory or version-specific fix has been independently confirmed. Treat this as a pending-patch situation until Elastic publishes an official advisory.

1) Immediate Mitigations (until official patch is verified):

a. API/Role Restriction: Temporarily restrict the Elastic Security Kibana feature privilege to only those users who definitively require it. Since the vulnerable feature relies on this privilege, reducing the population that holds it narrows the attack surface.

b. Disable Field Suggestion Feature: If the Kibana deployment supports feature-flag or configuration-level disabling of endpoint policy field-value suggestions, disable this capability until the patch is applied. Check Kibana configuration for any policies or settings controlling the Elastic Security autosuggest/field-value feature.

c. Network Restriction: Ensure Kibana is not exposed to the internet. Restrict access to trusted networks only. Require VPN or bastion host access.

d. Monitor Audit Logs: Implement and tune the Sigma/Splunk/Elastic detection rules provided above to monitor Elasticsearch audit logs for anomalous Kibana service account queries to Elastic Defend indices.

e. Review User Privileges: Audit all current Kibana users with Elastic Security feature privileges. Revoke access for accounts that do not have a demonstrated business need. Pay special attention to contractor, vendor, and terminated-user accounts.

2) Patch / Upgrade Steps:

a. Monitor Elastic Security Advisories: Check the Elastic security advisory page and the Kibana release notes regularly for an official fix for CVE-2026-72672.

b. Upgrade When Available: Once Elastic publishes a patched version, upgrade Kibana in a staging environment first, validate functionality, and then deploy to production clusters. Follow Elastic's standard rolling upgrade procedure for Kibana and ensure Elasticsearch compatibility.

c. Verify Patch Authenticity: Because the patch claim is from a single source only, verify the fix by confirming the vendor advisory, comparing version hashes where available, and testing the vulnerable scenario in a staging environment (log in with a user that has Elastic Security feature role but no index read access, then attempt to trigger field-value suggestions).

3) Long-Term Hardening:

a. Apply Principle of Least Privilege: Regularly audit Elastic Security feature privilege assignments. Users should only receive the minimum privileges needed.

b. Enable and Monitor Elasticsearch Audit Logs: Ensure audit logging is enabled at the Elasticsearch layer to capture search operations, user context, and index access.

c. Separate Data Tiers: Consider separating Elastic Defend event indices into a dedicated cluster or tenant where access is tightly controlled and Kibana feature access is isolated.

d. Credential Hygiene: Process command-line arguments are a frequent source of leaked secrets. Enforce the use of environment variables or secret-management solutions instead of embedding credentials in process command lines across the organization.

e. File a Vendor Inquiry: Contact Elastic support or your account representative to ask for confirmation of the patch status, affected versions, and upgrade timeline. If you have a support contract, request direct confirmation of remediation.

f. Stay Current on Threat Intelligence: The EPSS percentile (16%) indicates low current exploitation likelihood, but this can change rapidly once exploit details are published. Maintain awareness of new advisories related to this CVE via threat intelligence feeds and the CISA Known Exploited Vulnerabilities catalog.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72672 Primary authoritative source for the CVE description and CVSS scoring. Confirms CWE-863 classification and patch claim (2/4 confidence).

2. Elastic Security Advisories (pending): https://www.elastic.co/security/advisories Vendor advisory portal. At the time of writing, no specific advisory for CVE-2026-72672 has been published. Organizations should monitor this URL for official fix announcements and affected version details.

3. MITRE ATT&CK Technique Reference — T1552 (Unsecured Credentials): https://attack.mitre.org/techniques/T1552/ Classifies the credential-harvesting outcome of this information disclosure vulnerability. Command-line argument extraction aligns with T1552.001 (Credentials In Files) in the post-compromise access context.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog CVE-2026-72672 is NOT currently listed in the KEV catalog. Review this catalog periodically, as CISA may add the CVE if exploitation is confirmed in the wild.

5. EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ CVE-2026-72672 holds an EPSS score of 0.00248 (16.0% percentile), indicating low predicted probability of exploitation in the near term. Re-evaluate as technical details disseminate.

Threat Actor Campaigns: No known threat actor campaigns, exploit-in-the-wild activity, or ransomware group associations have been identified for CVE-2026-72672 as of this report's date. The absence of public exploit code and the low EPSS score suggest that active exploitation has not yet been observed. Organizations should nonetheless prioritize patching given the sensitive nature of the exposed data and the low complexity of the attack once details become public.