Description

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-26T21:16:55.540Z",
  "pubdate": "2026-09-26T21:16:55.540Z",
  "executiveSummary": "The Kibana Agent Builder is susceptible to a Confused Deputy vulnerability categorized under CWE-441. This flaw allows a non-administrative user with agent modification permissions to manipulate shared agents, effectively leveraging a higher-privileged user as a proxy to perform unauthorized operations. By tricking a privileged user into interacting with a compromised agent configuration, an attacker can escalate privileges within the Kibana environment. If the attacker also possesses workflow authoring capabilities, this vulnerability facilitates full administrative takeover of both the Kibana instance and the underlying Elasticsearch cluster. The attack requires the ability to edit shared agents, making access control and segmentation critical defensive measures. The risk is significant, as it transforms a low-privileged user into a vector for systemic compromise, undermining the security posture of the entire Elastic stack deployment.",
  "technicalDetails": "The vulnerability resides in the Kibana Agent Builder component and stems from a logical flaw in how shared agents process configuration and execution instructions. Specifically, the system exhibits a 'Confused Deputy' behavior where the application fails to validate the context and origin of an operation performed on behalf of an agent when accessed by different users.\nThe attack flow initiates when a non-administrative user, who maintains 'edit' permissions on a shared agent, injects malicious configurations or workflows into the agent's definition. Because the agent's operations are associated with the identity of the user interacting with it, the system does not sufficiently distinguish between the creator of the agent and a subsequent user managing or triggering the agent's tasks. When a higher-privileged user, such as an administrator, later accesses or triggers an operation on the modified shared agent, the Kibana Agent Builder executes these operations under the security context of the administrative user.\nThis implicit trust in the session context allows for privilege escalation. The malicious configuration effectively hijacks the administrative session. When the attacker possesses the secondary ability to author workflows, the scope of the exploit expands exponentially. The attacker can define workflows that execute arbitrary administrative commands or data retrieval tasks against the Elasticsearch cluster, effectively bypassing Role-Based Access Control (RBAC) mechanisms. By using the higher-privileged user as an unwitting intermediary, the attacker bypasses standard authorization checks that would otherwise prevent a low-privileged user from executing cluster-level actions. The exploitation is silent, as the actions appear to originate from the legitimately authenticated administrator, complicating incident response and audit trail reconstruction. The lack of strict verification of the agent's modification history against the current user's privileges constitutes the root cause of this failure."
}