---
cve: "CVE-2026-72668"
severity: "HIGH"
cvss: 7.3
epss: "0.2%"
vendor: "Elastic"
kev: false
exploited: false
published: "2026-09-26 21:16:55"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-28T21:57:07+02:00"
---

# CVE-2026-72668

> 7.3 HIGH

## Beschreibung

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

## CNA-Record (Kanon, cvelistV5)

- CNA: **elastic**
- State: PUBLISHED
- Stand: 2026-09-28 13:31:31
- CNA-CVSS: **7.3** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-441** — Unintended Proxy or Intermediary ('Confused Deputy')
  The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the…

## Angriffsmuster (CAPEC)

- [CAPEC-219 — XML Routing Detour Attacks](https://capec.mitre.org/data/definitions/219.html) _(Severity: Medium)_
- [CAPEC-465 — Transparent Proxy Abuse](https://capec.mitre.org/data/definitions/465.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1090.001 — Proxy: Internal Proxy](https://attack.mitre.org/techniques/T1090/001/)

## BSI-Hinweise (deutsch)

- [Kibana: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3575) — _BSI-Einstufung: mittel_
  Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, und um einen Denial of Service Angriff durchzuführen.

## Referenzen

- <https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-72668) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_