{"id":"CVE-2026-72670","summary":"Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials","details":"A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.","aliases":["BIT-elk-2026-72670","BIT-kibana-2026-72670"],"modified":"2026-09-06T08:14:57.359197Z","published":"2026-08-13T19:11:13.262Z","database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72670.json","unresolved_ranges":[{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.19.19"},{"introduced":"9.0.0"},{"last_affected":"9.4.4"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72670.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72670"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"0"},{"fixed":"91f5381ece296ddc32b554f997269478b9224af8"},{"introduced":"112859b85d50de2a7e63f73c8fc70b99eea24291"},{"fixed":"adc1f04ffdd393d1977990338d5512c5eaf1ce94"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.19.20"},{"introduced":"9.0.0"},{"fixed":"9.4.5"}],"source":"CPE_RANGE"}}],"versions":["v9.4.4","v8.19.19","v8.19.18","v9.4.3","v8.19.17","v8.19.16","v9.4.2","v9.4.1","v9.4.0","v8.19.15","v8.19.14","v8.19.13","v8.19.12","v8.19.11","v8.19.10","v8.19.9","v8.19.8","v8.19.7","v8.19.6","v8.19.5","v8.19.4","v8.19.3","v8.19.2","v8.19.1","v8.19.0","v8.0.0-alpha2","v8.0.0-alpha1","v7.0.0-alpha2","v7.0.0-alpha1"],"database_specific":{"vanir_signatures_modified":"2026-09-06T08:14:57Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["283190670438501987514727838726815920477","139872482520600089094968553951135983484","244928736363048457427079246025589015191"],"threshold":0.9},"id":"CVE-2026-72670-15fc2a3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighterTests.java"}},{"digest":{"function_hash":"35973537492193988444530376691395407843","length":2369},"id":"CVE-2026-72670-3749bff4","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"function":"setupParser","file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/AbstractHighlighterBuilder.java"},"deprecated":false},{"target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilder.java"},"deprecated":false,"digest":{"line_hashes":["114508176030696626539066047296433779214","43384607500169746049581282043376952148","283563727296098110195444588655154165811","277031765205288332698033581440269116720","187407052376657667672985622362187421922","90126549817761157374395826113896432271","62431126033836515299954878706677890458","276372619117036678140958072933552714348","34204804071724460000309539643270206424","178874689487166837173458238589286447776"],"threshold":0.9},"id":"CVE-2026-72670-56785d56","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94"},{"id":"CVE-2026-72670-687797ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"function":"highlight","file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighter.java"},"deprecated":false,"digest":{"function_hash":"74600334261879604741521313242640339568","length":4662}},{"deprecated":false,"digest":{"length":176,"function_hash":"10160088286724545746756661846724288313"},"id":"CVE-2026-72670-6e669937","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java","function":"getFieldType"}},{"source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/rest/action/search/SearchCapabilities.java"},"deprecated":false,"digest":{"line_hashes":["130192812032915568189929366428112074279","338587668112843751875004607897056457244","311636223832287298418351940618914661904","14559433973571236327103093772803942734","81766092491860980139880041074416541030","83778004218823664808743686188872036723","217672029278899031516016760140755058444"],"threshold":0.9},"id":"CVE-2026-72670-9734acfc","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/AbstractHighlighterBuilder.java"},"deprecated":false,"digest":{"line_hashes":["243868588130949656791143692081236563864","311505216586199373294314499230294889565","23300629379259170631342652985157100415","99779525804820300359777388439313924719","124392759507223488964887386448798184793","57056074566821104672192600168236166604","183428232184500482658775793061523078930"],"threshold":0.9},"id":"CVE-2026-72670-bd63b83e","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["122639132757664986803138175691671001655","335892283999867396276535502941166644649","252845685254806679929754126735709659653","70459544080609156892578956654685198979","288350301639674802567568120843372854348","128879439556083118790804565740578695567","183568503689704087885138164738553210791","315988264130765396628199666193426980549","110105306531665817097053229432225710351","108886619290626151118397149603734671098","68900764452827513161409585113073530589","109699481272201296627752008736891181922","89552474233322494405147063649180198152","243794874480578150177830085733756836217","128936352400535787295390066296206280301","168193967744077208144892951303807415035","32485489507345202777470620624306770167","82468793747458534960176489784612968344","95431536162858288727547312167888083055","79895802567313409968279279144916310561","109983373614664327492018760324106301607","254164139643632659290414288579740637195","218911482828271878345863242741149783938","290149128642774742559654272690374710990","129649976829885946269329561068451864187","271521553609249011929656203339955131993","116967678018103273313850160203491775016","34507466461561024444180968955125864688","149539466270008484339757108260134471872","241540141246676079432554907112288153733","247281622777097759942516432384261889326","8682106367820934505412234917026602498","258599880353756871245323998211345504441","140682565192181975671989624265695960587","100268892565605616091333444189761449681","214950598829781998119271592022997186976","200550104524719405385075838124186899375","313720121068230248463194804287647092807","188167255630204728049901172366742944889","197051329735330186721065881872811534640","246392715163119707808625433035684232434","127945619089996738346525337879859203179","136702270964155933380398036066653195170"]},"id":"CVE-2026-72670-ca3692e7","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilder.java","function":"build"},"deprecated":false,"digest":{"function_hash":"186492591955110081095185334864085897708","length":674},"id":"CVE-2026-72670-dc0a4f96","signature_type":"Function","signature_version":"v1"},{"target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java","function":"testBuildSearchContextHighlight"},"deprecated":false,"digest":{"function_hash":"50460798663850937323875144151113267593","length":3586},"id":"CVE-2026-72670-e5c86fee","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94"},{"target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighter.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["250502453778712768962053518703255093608","293745187741608286289486472330502044902","92285933861987769382932879499624280339","48848052402887098574079705828368727963","180954780310110417851376237840132855867","265701660666103015958674140349152633739","219483656979539974598819100907886798376"]},"id":"CVE-2026-72670-f6f0ec86","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72670.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"0"},{"fixed":"4036be744384423f261fcf74b1b99fd4d044dc97"},{"introduced":"504d6bfa94cca17fabb76e06152c30c4f0c3efdd"},{"fixed":"bc80ff828630b51dd591207f43a54ea5ebf53270"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.19.20"},{"introduced":"9.0.0"},{"fixed":"9.4.5"}]}}],"versions":["v8.19.19","v9.4.4","v8.19.18","v9.4.3","v8.19.17","v9.4.2","v8.19.16","v9.4.1","v9.4.0","v8.19.15","deploy@1775456092","v8.19.14","deploy@1774851440","deploy@1774246725","deploy@1773858623","v8.19.13","deploy@1773641703","deploy@1773036835","deploy@1772432307","v8.19.12","deploy@1771827228","deploy@1771222690","deploy@1770617847","deploy@1770012923","v8.19.11","deploy@1769408156","deploy@1768803256","deploy@1768218634","deploy@1768198527","v8.19.10","deploy@1767593647","deploy@1766988978","deploy@1766384231","v8.19.9","deploy@1765779173","deploy@1765174614","deploy@1764659574","v8.19.8","deploy@1763964909","deploy@1763360043","deploy@1762755325","v8.19.7","deploy@1762150324","deploy@1761545598","v8.19.6","deploy@1760335957","v8.19.5","deploy@1759731406","deploy@1759126366","deploy@1758521525","v8.19.4","deploy@1757916930","deploy@1757311879","deploy@1756707119","deploy@1756102496","v8.19.3","deploy@1755497723","deploy@1754931892","v8.19.2","v8.19.1","deploy@1754288252","deploy@1753683246","v8.19.0","deploy@1753078461","deploy@1752473612","deploy@1751868905","deploy@1751277018","deploy@1751264043","deploy@1750659199","deploy@1750054502","deploy@1749449628","deploy@1748942782","deploy@1748844884","deploy@1748239962","deploy@1747635089","deploy@1747030444","deploy@1746425571","deploy@1745820726","deploy@1745272860","deploy@1744611164","deploy@1744006300","deploy@1743401509","deploy@1742796690","deploy@1742191921","deploy@1741587091","deploy@1740982600","deploy@1740377517","deploy@1739772912","deploy@1739168190","deploy@1738563299","deploy@1737958429","deploy@1737353792","deploy@1736748791","deploy@1736144018","deploy@1735539127","deploy@1734934371","deploy@1734329529","deploy@1733724770","deploy@1733120035","deploy@1732515196","deploy@1731910526","deploy@1731305644","deploy@1730700921","deploy@1730095989","deploy@1729491328","deploy@1728886420","deploy@1728281754","deploy@1727676838","deploy@1727071987","deploy@1726473511","deploy@1725862301","deploy@1725257503","deploy@1724652827","deploy@1724047965","deploy@1723443177","deploy@1722838314","deploy@1722233551","deploy@1721628835","deploy@1721023892","deploy@1720419201","deploy@1719814351","deploy@1719209622","deploy@1718616070","deploy@1718000036","deploy@1717401777","deploy@1717395230","deploy@1716800745","deploy@1716790412","deploy@1716185667","deploy@1715580861","deploy@1714976069","deploy@1714371303","deploy@1713766425","deploy@1713161715","deploy@1712566963","deploy@1711952105","deploy@1711370131","deploy@1710741924","deploy@1710146776","deploy@1710137117","deploy@1709533819","deploy@1709532332","deploy@1708927574","deploy@1708322739","deploy@1707717945","deploy@1707113127","deploy@1706508321","deploy@1705903520","deploy@1705306975","deploy@1705298718","deploy@1704693922","deploy@1704089101","deploy@1703484304","deploy@1702903357","deploy@1702879551","deploy@1702367069","deploy@1702284899","deploy@1701687168","deploy@1701160888","deploy@1700491293","deploy@1699865290","deploy@1699260155","deploy@1698657637","deploy@1698046713","deploy@1697564183","deploy@1697232175","test-depl-20231025084603","test-depl-20231013154558","deploy@1697028216","deploy@1696873111","deploy@1696618725","deploy@1696508231","deploy@1696415195","deploy@1696328885","deploy@1695286747","deploy@1694683198","deploy@1694506029","deploy@1694162455","deploy@1694087994","deploy@1693866333","deploy@1693860790","deploy@1693853982","deploy@1693609987","deploy@1693594780","v8.0.0-alpha2","v8.0.0-alpha1","v7.0.0-alpha1","7.0-known-good","v6.0.0-alpha2","v6.0.0-alpha1","v5.0.0-alpha5","v4.2.0-beta1","v4.0.0-beta3","v4.0.0-beta2","v4.0.0-beta1.1","v4.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72670.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}