CVE-2026-72672

This vulnerability in Kibana's autocomplete feature allows users with standard Kibana feature privileges to access sensitive data from Elastic Defend indices—including process command line arguments that contain plaintext tokens, credentials, and connection strings. The root cause is not a missing check but a design pattern: the autocomplete path uses Kibana's internal Elasticsearch service account rather than propagating the caller's authorization context into the downstream query. Because the internal account has broad Elastic Defend index access for operational purposes, any Kibana user with feature-level access bypasses the Elasticsearch index privilege layer entirely. The critical question for defenders is whether your Kibana service account has unnecessarily broad index permissions. Check the Elasticsearch roles assigned to Kibana's internal user and audit whether Elastic Defend indices need that access level. This vulnerability demonstrates that Kibana feature privileges and Elasticsearch index privileges represent separate authorization boundaries that must be explicitly composed—code paths that bridge them cannot rely on implicit trust from the internal service account. Audit other Kibana features that serve aggregated or suggested data for the same internal-account substitution pattern. Features optimized for responsiveness are the most likely to have adopted this shortcut. If the fix was a targeted authorization gate rather than a re-architecture to propagate caller context, assume similar patterns exist elsewhere and prioritize a systematic audit of your query proxy layer.

Reviewed through automated stages and approved by a human before publication.