CVE-2026-72670High· 7.7▾ TwilightA lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.
kibana < 8.19.20kibana >= 9.0.0, < 9.4.5Upgrade past the affected range:
kibana 9.4.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42399Medium· 6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-42400Medium· 6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-42398High· 7.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist
CVE-2026-42401Medium· 4.1Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection
CVE-2026-33462Medium· 4.6A path traversal vulnerability was identified in Kibana's dashboard management functionality
CVE-2026-33463Medium· 5.3Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure