VULNERABILITY INTELLIGENCE

CVE-2026-72658

CVSS score7.3 HIGH
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-08-13
Last modified2026-09-02
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Description

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

Weakness classification

  • security@elastic.co: CWE-352

Primary references