CVE-2026-72668
published 2026-09-26CVE-2026-72668: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit…
PriorityP343high7.3CVSS 3.1
AVNACLPRLUIRSUCHIHAN
EPSS
0.18%
7.0th percentile
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | 9.4.0 – 9.4.6 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation.
ghsa_unreviewed·2026-09-26
CVE-2026-72668 [HIGH] CWE-441 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation.
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.
VulDB
Elastic Kibana up to 9.4.6 Agent Builder confused deputy
vuldb·2026-09-26·CVSS 7.3
CVE-2026-72668 [HIGH] Elastic Kibana up to 9.4.6 Agent Builder confused deputy
A vulnerability has been found in Elastic Kibana up to 9.4.6 and classified as critical. This impacts an unknown function of the component Agent Builder. This manipulation causes unintended intermediary.
The identification of this vulnerability is CVE-2026-72668. It is possible to initiate the attack remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-26
Published