CVE-2026-72670: Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72670?
CVE-2026-72670 has a severity rating of high, with a CVSS score of 7.7.
How do I fix CVE-2026-72670?
To mitigate CVE-2026-72670, ensure that proper access controls are enforced and limit privileges for users allowed to read agent policies.
What type of vulnerability is CVE-2026-72670?
CVE-2026-72670 is categorized as an information leak vulnerability, allowing lower privileged users to access sensitive configuration data.
What sensitive information is exposed in CVE-2026-72670?
CVE-2026-72670 potentially exposes proxy authentication credentials and private key material to unauthorized users.
Which software is affected by CVE-2026-72670?
CVE-2026-72670 affects Elastic Kibana versions that allow lower privileged users to access Fleet proxy configurations.