CVE-2026-72661

CVE-2026-72661 exposes a fundamental authorization boundary failure in Elastic Defend's interaction with Kibana's internal retrieval mechanisms. The vulnerability isn't a simple missing check — it's an authorization context inversion where the internal Kibana retrieval capability executes with elevated internal permissions rather than filtering data through the requesting user's permission set. A user authenticated to Kibana at standard privileges can trigger this internal path and receive data they shouldn't access. What makes this particularly dangerous is what's actually being exposed. This isn't generic data disclosure — endpoint response action records contain operational outputs of an EDR system actively managing compromised hosts: command execution results, memory dumps, process lists from infected systems. An attacker who obtains this information gains exactly the operational intelligence needed to understand what the EDR has already detected and how to evade it. The second-order impact extends to every active investigation and containment action on hosts where Elastic Defend is operating. The CVSS 6.5 severely underspecifies this risk. The deeper architectural failure is that "internal" and "user-facing" were treated as social categories in documentation rather than enforced separations in code. Internal Kibana retrieval capabilities were designed assuming calls originate from trusted internal components, not from authenticated user sessions passing through the web layer. When the plugin architecture connects these internal paths to user-accessible interfaces, the authorization assumption breaks. The absence of enforced boundaries between internal and external API surfaces as a first-class design constraint means this isn't an isolated incident — it's a structural condition that likely exists elsewhere in Elastic's plugin ecosystem. Audit your Elastic deployment for other internal Kibana retrieval mechanisms that may similarly bypass user permission contexts. Prioritize hunting for anomalous access patterns to endpoint response data, particularly from standard-privilege user sessions. Treat any internal capability that's connected to user-facing paths as a potential boundary failure until proven otherwise. The fix must go beyond patching this endpoint — Elastic needs to treat internal-to-internal calls as requiring the same authorization tracing as user-facing paths, making trust boundaries explicit in the framework rather than relying on convention.

Reviewed through automated stages and approved by a human before publication.