CVE-2026-72665

This is a privilege escalation vulnerability in Elastic Security where the detection rule evaluation context was implicitly trusted as an authorization boundary for response actions. A user with legitimate detection-rule authoring access can trigger Osquery or Elastic Defend responses on any enrolled endpoint without actually holding the Osquery or Elastic Defend privileges that should gate those capabilities. The system trusted the rule-evaluation context to authorize response dispatch rather than requiring independent privilege verification at the point of action execution. The critical failure is architectural: rule engines run with elevated access to gather telemetry for matching — that's a performance and data-access necessity. But response actions produce observable or destructive effects on endpoints, carrying fundamentally different risk profiles. The authorization boundary between these two contexts wasn't enforced where rule evaluation could trigger actions. A user who legitimately gains rule-authoring access can bypass the privilege checks that should govern response execution. The blast radius is significant. This affects a population typically 10-20x larger than the admin population in a typical SOC — threat hunters, SOC analysts, and tier-2 staff who author detection rules but don't hold response privileges. The exploitation scope isn't limited to one host the attacker already has access to; it extends to every enrolled endpoint, simultaneously, including domain controllers, identity providers, and CI/CD pipelines that Elastic Defend monitors. The fix's architecture determines how well this resists future bypass. If it introduces a hard enforcement gate at the response-dispatch layer that verifies privileges independently of how the request arrived, that's a robust posture. If it merely adds a check within the rule-evaluation path that could be circumvented through alternative entry points, expect recurrence. The same trust boundary likely exists in other detection workflows — timelines, hunting queries, or any code path that reaches response capabilities through elevated telemetry-gathering contexts. Assume similar authorization gaps exist in parallel detection workflows until proven otherwise. Verify the fix is enforced at the dispatch layer, not just at the Kibana rule-authoring entry point.

Reviewed through automated stages and approved by a human before publication.