Cross-Site Request Forgery in Kibana Leading to Privilege Escalation
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
Affected Versions:
- All versions from 8.19.0 up to and including 8.19.19
- All versions from 9.0.0 up to and including 9.4.4
Affected Configurations:
All configurations are affected.
Solutions and Mitigations:
The issue is resolved in versions 8.19.20 and 9.4.5.
For Users that Cannot Upgrade:
Self-Managed
Disable the Vega visualization type by setting vis_type_vega.enabled: false in kibana.yml and restarting Kibana. Existing Vega visualizations and any dashboards that embed them will no longer render.
Cloud
Elastic Cloud Hosted deployments can apply the same setting through the Kibana user settings override in the Cloud Console, where that setting is permitted for the deployment version.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 7.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVE ID: CVE-2026-72658
Problem Type: CWE-352 - Cross-Site Request Forgery
Impact: CAPEC-62 - Cross Site Request Forgery