CVE-2026-72680: 
Kibana vulnerability analysis and mitigation

CVE-2026-72680 is an authorization bypass vulnerability in the Kibana Agent Builder A2A JSON-RPC API endpoint, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The flaw allows an authenticated user with only Agent Builder read privilege to overwrite and reassign another user's stored conversation to their own account within the same Kibana space. Affected versions are Kibana 9.2.0 through 9.4.4 (inclusive); versions outside this range are unaffected by default. It was published on August 13, 2026, with a patch available in Kibana 9.4.5. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, Elastic Advisory).

The root cause is an insecure direct object reference (IDOR) pattern classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The Kibana Agent Builder A2A JSON-RPC API derives the identifier of a stored conversation directly from user-supplied input, and the server-side ownership check fails to differentiate between a non-existent conversation and one that exists but belongs to a different user in the same space. An authenticated attacker with only read-level Agent Builder privileges can supply a known or guessed conversation identifier belonging to another user, causing the API to overwrite and reassign that conversation without triggering an authorization error. No public proof-of-concept code has been identified (GitHub Advisory, Elastic Advisory).

Successful exploitation results in permanent loss of integrity and availability of the targeted conversation: the original owner loses all access to the conversation and its full history, and the conversation is reassigned to the attacker's account. Confidentiality is not impacted — the attacker does not gain read access to the overwritten content. The scope is limited to individual conversations within a shared Kibana space; there is no evidence of lateral movement potential or broader system compromise (GitHub Advisory, Elastic Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.212% (12th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Elastic Advisory).

1. Reconnaissance: Identify a Kibana instance running version 9.2.0–9.4.4 with the Agent Builder feature enabled. Confirm that the attacker holds a valid account with at least Agent Builder read privilege in the target space.
2. Enumerate conversation identifiers: Observe or infer conversation identifiers used by other users in the same Kibana space. Identifiers may be discoverable through shared UI elements, logs, or by brute-forcing predictable ID formats.
3. Craft malicious JSON-RPC request: Construct an A2A JSON-RPC API request to the Agent Builder endpoint, supplying the target conversation's identifier as the user-controlled key in the request body.
4. Submit the request: Send the crafted request to the Kibana Agent Builder A2A JSON-RPC API endpoint while authenticated. The flawed ownership check accepts the identifier without verifying that it belongs to the requesting user.
5. Conversation overwritten and reassigned: The API overwrites the target conversation with the attacker's data and reassigns ownership to the attacker's account. The original owner permanently loses access to the conversation and its history (GitHub Advisory, Elastic Advisory).

• Logs: Kibana audit logs showing Agent Builder A2A JSON-RPC API requests from a user account that does not own the referenced conversation identifier; repeated API calls with varying conversation identifiers from a single low-privileged account.
• Application Behavior: Users reporting sudden loss of access to Agent Builder conversations or unexpected changes in conversation ownership within a shared Kibana space.
• Network: Unusual volume of JSON-RPC POST requests to the Kibana Agent Builder API endpoint from a single authenticated session, potentially indicating identifier enumeration activity.

Elastic has released Kibana 9.4.5 to address this vulnerability; users running versions 9.2.0 through 9.4.4 should upgrade immediately (Elastic Advisory). As a workaround prior to patching, restrict Agent Builder access to only fully trusted users and avoid granting read-only Agent Builder privileges to untrusted accounts in shared spaces. Monitor Kibana audit logs for anomalous conversation reassignment activity as an additional defensive measure.

The vulnerability was covered by threat intelligence aggregators including Tenable, VulDB, and ENISA's EUVD shortly after disclosure. The NetEye blog published a security advisory for Elastic Stack users on August 14, 2026 (NetEye Blog). No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking coverage.