CVE-2026-72658
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Cross-Site Request Forgery in Kibana can lead to privilege escalation. A user allowed to create visualizations can save a crafted Vega visualization that, when opened by another user, triggers authenticated requests in the victim's session.
Risk Assessment
The risk includes privilege escalation, as an attacker can perform actions on behalf of the victim, potentially leading to unauthorized data access or configuration changes.
Recommendation
Implement CSRF protections such as anti-CSRF tokens and restrict Vega visualization creation to trusted users.
Original NVD description (English source)
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.