CVE-2026-72643: Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72643?
CVE-2026-72643 has a high severity rating of 7.1.
How do I fix CVE-2026-72643?
To fix CVE-2026-72643, update to the latest version of Elastic Kibana Agent Builder that addresses this vulnerability.
What are the risks associated with CVE-2026-72643?
CVE-2026-72643 can lead to unauthorized disclosure and tampering of private agents.
What causes CVE-2026-72643?
CVE-2026-72643 is caused by incorrect authorization checks in Kibana Agent Builder related to user identifier comparisons.
Who is affected by CVE-2026-72643?
Users of Elastic Kibana Agent Builder are affected by CVE-2026-72643 due to its flawed authorization mechanism.