CVE-2026-72681

CVE-2026-72681 is a confused-deputy vulnerability in Kibana's Agent Builder that lets users with agent-creation permissions invoke downstream features—Watcher, Maps, reporting—without those features independently verifying the caller's authorization. The Agent Builder checks whether you can build agents, then trusts the resulting tool to enforce its own access controls when executed. This is backwards. Permissions should be checked at the moment of execution, not just at tool creation time. The 6.5 CVSS score captures a single feature chain, but the real risk is superlinear in composed scenarios. Agent Builder doesn't just expose one unauthorized API call—it lets attackers automate, schedule, and chain cross-feature pipelines that run indefinitely on a cron. A user who can build agents can construct pipelines that sweep across Watcher outputs, Maps aggregations, and reporting artifacts without manual interaction after initial setup. The blast radius is 'one unauthorized API call, every hour, indefinitely,' not a one-time exposure. This is a structural flaw in Kibana's feature delegation model, not a missing null check. The framework makes the insecure option easier than the secure one—internal feature APIs were built incrementally with no enforced authorization contract at boundaries. When a developer needs Watcher functionality inside Agent Builder, the path of least resistance is `watcherService.doThing(userContext)` rather than an explicit authorization verification at every cross-feature call. This developer ergonomics failure at the framework level is why the pattern almost certainly exists elsewhere in Kibana's feature composition surface (Watcher, Maps, custom reporting jobs). The 2026 embargo date is significant. It suggests Elastic and researchers held this for coordinated disclosure, which implies it was classified as an architectural finding worth extended internal review—not a quick-patch code defect. That classification is diagnostic: the vendor recognized this as a framework-level failure. The embargo also raises the question of whether similar patterns exist in Elasticsearch's role-based access controls that weren't caught in the same sweep. Audit for this pattern now. The EPSS (0.00252) is low because tooling hasn't surfaced this yet—but this is exactly the vulnerability class that matures into something serious once it does. Standard penetration tests and SOC 2 audits miss this because they scope to user-facing permission boundaries and assume internal service calls are within the trusted computing base. The authorization contract between Agent Builder and Watcher isn't a user boundary, so it falls into the gap between audit scopes. Before patching, audit existing Agent Builder workflows for cross-feature dependencies. The fix likely enforces runtime permission checks at every feature boundary—and that breaks existing agents built on implicit trust. Organizations with fragile agent workflows may delay patching because the remediation breaks production automation they depend on. The 6.5 score will let security teams deprioritize it. The workflow breakage will let engineering teams delay it. That's the failure cascade to watch: not just the vulnerability's scope, but the remediation resistance created by the architecture.

Reviewed through automated stages and approved by a human before publication.