CVE-2026-72668

Katalog CVE

CVSS 7.3 · High EPSS 0,18%

Kerentanan Unintended Proxy or Intermediary ('Confused Deputy'). Skor CVSS 3.1 7.3 (High) menurut elastic.co.

Deskripsi (NVD)

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

Rincian

Terbit di NVD

26 September 2026

Terakhir diubah

29 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.3 (High), sumber elastic.co
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678