Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.
Affected Versions:
- All versions from 9.2.0 up to and including 9.4.4
Affected Configurations:
- Only conversations created through the agent-to-agent interface are affected, and the attacker must know or already share the identifier value used to create the target conversation
Solutions and Mitigations:
The issue is resolved in version 9.4.5.
For Users that Cannot Upgrade:
- Disable Agent Builder globally by setting xpack.agentBuilder.enabled: false in kibana.yml and restarting Kibana. This fully removes exposure but also removes all Agent Builder functionality.
- Disable the Agent Builder feature in every Kibana space through Spaces management. This blocks the affected API as well as the user interface and does not require a restart, but must be applied to all spaces to be effective.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVE ID: CVE-2026-72680
Problem Type: CWE-639 - Authorization Bypass Through User-Controlled Key