CVE-2026-72681

8.8 Élevée

Publiée le 13/08/2026 à 22:17 · Modifiée le 03/09/2026 à 20:59 · Analysée par le NVD · Source : security@elastic.co

Description

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security@elastic.co	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
3.1	8.8 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-862

Références

https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories