CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation
A non-admin user can escalate privileges to full administrative control by manipulating shared agents in Kibana Agent Builder.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-72668?
CVE-2026-72668 is a high-severity vulnerability in Elastic Kibana, published on 26 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.
Weakness: CWE-441
Which versions are affected by CVE-2026-72668?
2 open source packages ship an affected version, including kibana and elk.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | From 9.4.0 | 9.4.7 |
elk Bitnami | From 9.4.0 | 9.4.7 |
How do I fix CVE-2026-72668?
Upgrade kibana to 9.4.7 or later.
Is CVE-2026-72668 being exploited?
There is no known exploitation of CVE-2026-72668 in the wild and no public exploit code.
Sources
Also known as BIT-elk-2026-72668, BIT-kibana-2026-72668, GHSA-r4ff-jqf2-8p5g, MINI-fm9w-337j-gjhw.