Vulnerability in Elastic Kibana

[ Description ]Official description

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR25 Sep 2026CERTFR-2026-AVI-1228

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-72662CVE-2026-94398CVE-2026-94396+8 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3575

  Kibana: Multiple vulnerabilities Translated from German

  CVE-2026-78582CVE-2026-94400CVE-2026-72662+1 more CVEs

[ References ]References

• discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678