CVE-2026-72665

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Missing authorization allows a user capable of authoring and evaluating Elastic Security detection rules to execute Osquery and Elastic Defend response actions on managed hosts. This occurs because certain functionality is not properly constrained by Access Control Lists (ACLs), which are sets of rules that define permissions for users or systems to access specific resources. Consequently, an attacker can perform actions against enrolled agents without possessing the required Osquery live query or Elastic Defend response action privileges, potentially leading to unauthorized state changes or information disclosure from the affected hosts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.