Detections
Analytics
CVE-2026-72681
medium
Description
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.
References
https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534