CVE-2026-72669 Elastic CVE debrief

Who should care

Users of Elastic Kibana, especially those with Observability Onboarding flows, should review and update their instances to prevent unauthorized access and data manipulation. This includes administrators, security teams, and operators responsible for maintaining Kibana instances and ensuring the security of their environments. Additionally, vulnerability management teams should prioritize patching affected instances and monitoring for potential exploitation attempts.

Technical summary

The state stored for an Observability Onboarding flow in Kibana is not bound to the user who created it, allowing authenticated users with generic read access to discover, read, and write arbitrary progress data into onboarding flows, potentially causing server errors. This vulnerability affects Kibana instances with Observability Onboarding flows and can be mitigated by restricting access and implementing compensating controls.

Defensive priority

Authenticated users with generic read access can discover, read, and write onboarding flow data, potentially causing server errors.

Recommended defensive actions

• Review and update Kibana to version 8.19.19 or 9.4.5
• Restrict access to Observability Onboarding flows
• Monitor for suspicious activity
• Implement compensating controls
• Conduct a thorough review of the current security posture
• Perform an asset inventory to identify potentially affected systems
• Establish a rollback change window for remediation efforts

Evidence notes

The CVE and NVD records provide details on the vulnerability in Kibana's Observability Onboarding flow, allowing unauthorized access and data manipulation. The vulnerability is caused by the state stored for an Observability Onboarding flow in Kibana not being bound to the user who created it. This allows authenticated users with generic read access to discover, read, and write arbitrary progress data into onboarding flows, potentially causing server errors. Evidence is limited to public CVE and NVD records, and defenders should verify affected Kibana instances and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.