Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)

Announcements Security Announcements
1

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops producing data for that space while the engine continues to report a healthy state to operators.

Affected Versions:

  • 9.x:
  • All versions from 9.1.0 up to and including 9.4.5
  • All versions from 9.5.0 up to and including 9.5.1

Versions prior to 9.1.0, including all 8.x releases, are not affected because the affected functionality did not exist.

Affected Configurations:

  • Kibana deployments running an affected version in which the Entity Analytics Privilege Monitoring engine has been initialized. Deployments that never initialized the engine are not exposed.
  • Exploitation requires an authenticated Kibana account with read-level Security feature access in the target space. No Elasticsearch privileges and no administrative privileges are required.
  • Both self-managed and Elastic Cloud Hosted deployments are affected. No non-default configuration is required.

Solutions and Mitigations:

The issue is resolved in Kibana versions 9.4.6 and 9.5.2.

For Users that Cannot Upgrade:

There are no workarounds for this vulnerability.

Indicators of Compromise (IOC)

No specific indicators of compromise have been identified for this vulnerability.

Elastic Cloud Serverless

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE ID: CVE-2026-72633
Problem Type: CWE-863 - Incorrect Authorization
Impact: CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs