CVE-2026-72670

EUVD-2026-58257
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
elasticCNA
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
elastickibana
8.0.0 ≤
𝑥
≤ 8.19.19
CNA
elastickibana
9.0.0 ≤
𝑥
≤ 9.4.4
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524