BIT-KIBANA-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

BIT-ELK-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

PT-2026-105103

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

PT-2026-105098

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

Kibana 9.4.x < 9.4.7 Privilege Escalation (ESA-2026-85)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.7. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-85 advisory. - Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A...

CVE-2026-72668

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

EUVD-2026-87792

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668

Kibana versions 9.4.0 through 9.4.6 are vulnerable to a Confused Deputy (CWE-441) flaw in the Agent Builder component. An authenticated non-administrative user with both Agent Builder and Workflows privileges can manipulate a shared agent to perform privileged operations under the identity of a h...

CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668: Unintended Proxy or Intermediary

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

PT-2026-99425

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description A Confused Deputy issue in Kibana Agent Builder allows a non-administrative user with permissions to edit a shared agent to trigger privileged operations. These operations are executed using t...

Kibana 9.4.7, 9.5.0 Security Update (ESA-2026-85)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations...

Kibana 9.3.x < 9.4.6 DoS (ESA-2026-84)

The version of Kibana installed on the remote host is 9.3.x or 9.4.x prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-84 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive...

CVE-2026-72682

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-72682 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-72682

Kibana is affected by an unbounded memory allocation flaw (CWE-770) triggered via the Agent Builder feature. An authenticated user with only read-level Agent Builder privileges can submit a specially crafted request that causes Kibana to consume unbounded memory, terminating the process and denyi...

EUVD-2026-69561

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-72682 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...

CVE-2026-72682 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounde...