CVE-2026-72669

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An issue exists where the state stored for an Observability Onboarding flow is not bound to the user who created it. Because the routes used to read and update this state do not verify ownership, an authenticated user with generic read access to the space can discover other users' onboarding flows, read their state, and write arbitrary progress data. Additionally, tampering with a flow can cause the original owner's onboarding view to fail with a server error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.