CVE-2026-72666

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An authorization bypass exists where a user can execute unauthorized queries against Elastic Agents assigned to a Kibana space they are not permitted to access. This occurs because functionality is not properly constrained by Access Control Lists (ACLs), which are security mechanisms used to define permissions for users or systems. A user authorized to perform Osquery live queries in one space can trigger queries on hosts in another space, leading to the disclosure of information from those hosts via the Osquery results data stream.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.