CVE-2026-72681 is a medium severity (CVSS 6.5) missing authorization flaw in Kibana Agent Builder, affecting 9.4.0 through 9.4.3. A user can create and run a tool that reaches another Kibana feature without holding its privileges. The fix is Kibana 9.4.4, and Elastic lists no workaround.
What's affected
Kibana 9.4.0 up to and including 9.4.3, all configurations, according to Elastic security announcement ESA-2026-83. It is resolved in 9.4.4. Elastic Cloud Serverless was patched before the announcement.
The weakness is CWE-862, missing authorization. Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. That allows privilege escalation and can disclose information the user is not authorized to read.
The vector is AV:N/AC:L/PR:L/UI:N with high confidentiality impact and none for integrity and availability. Elastic's own rating matches the record at 6.5. Elastic states that no specific indicators of compromise have been identified and that there are no workarounds.
How to check if you're exposed
Find the Kibana version. In the Kibana interface, open the help menu to see the version, or query the status API with credentials:
curl -s -u USER https://KIBANA_HOST:5601/api/status | grep -o '"number":"[^"]*"'
Versions 9.4.0 through 9.4.3 are affected. Earlier versions are not named in the announcement. If you use Elastic Cloud Hosted, check the deployment version in the Cloud console.
Then consider who can use Agent Builder. The flaw needs a low privilege user, so users with access to Agent Builder in a space are the population of concern. Review roles for users who can create tools.
free in-browser dependency scan is for application dependencies, and Kibana itself is patched through Elastic's releases.
What to do now
- Check the Kibana version of every deployment.
- Upgrade 9.4.x deployments to 9.4.4 or later.
- Review which roles can use Agent Builder, and limit it to those who need it.
- Review what data the tools users created can reach.
- Subscribe to Elastic security announcements for follow up releases.
Why it matters
CWE-862 appears when a new feature is added on top of existing ones. Kibana already enforces privileges for each of its features. Agent Builder lets users create tools that call those features, and the new path forgot to ask whether the user is allowed to use the feature being called.
That is a common pattern in products that add automation or AI layers. The new layer acts on behalf of the user, and unless it carries the user's permissions through, it becomes a way around them. The fix belongs in the layer, not in each feature.
Quick check
Is there a workaround?
Elastic states there are no workarounds. The fix is upgrading to Kibana 9.4.4.
Sources
Last reviewed: 18 October 2026.
