CVE-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

What is CVE-2026-72670?

CVE-2026-72670 is a high-severity vulnerability in Elastic Kibana, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

Weakness: CWE-200

Which versions are affected by CVE-2026-72670?

2 open source packages ship an affected version, including kibana and elk. It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2026-72670?

Upgrade kibana to a fixed version for your release line: 8.19.20 or 9.4.5.

Is CVE-2026-72670 being exploited?

There is no known exploitation of CVE-2026-72670 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-elk-2026-72670, BIT-kibana-2026-72670, GHSA-gh7x-jm44-9v5r, MINI-35jm-v9hm-4vwq, MINI-5mwm-pjc4-3383, MINI-7229-r758-rh39 and 4 more.