Status: UPDATED | Advisory ID: CVE-2026-72658
| CVE | CVE-2026-72658 |
| CVSS Score / Version | 7.3 (High) / CVSS v3.1 |
| Updated | 2026-09-02 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is low; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is none. |
| Affected products | elastic kibana |
| Classified as | CWE-352 (Cross-Site Request Forgery (CSRF)) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| elastic | kibana |
| Subsystems | General OT |
| Sectors | Multiple |
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session. (NVD)
Monitor elastic's web page for any future patch releases. See vendor advisory link below.