LoginSign Up
← Back to all sparks
Elasticsearch logo

Elasticsearch

DEVOPSINFRA · APIS
Velocity6.3

Search and analytics

elastic.co ↗

Agent Builder, Elastic's newest surface, is where most of this month's Kibana CVEs live.

security-advisoriesagent-builderauthorizationkibanafleetcoordinated-disclosure
◆Current state
The visible feed window is one coordinated disclosure batch: ten Kibana advisories published within a minute of each other on August 13, spanning the 8.19, 9.3, 9.4 and 9.5 branches. Four of the six most recent concern Agent Builder — private agents readable and tamperable by non-owners, an A2A JSON-RPC endpoint that derives a conversation id from user-supplied input, and a missing cross-feature privilege check. The remainder cover Fleet issuing over-scoped Elastic Agent API keys and an Elastic Defend endpoint-event disclosure via field-value suggestions.
◆Where it's heading
Authorization is the single recurring failure mode here — every one of these is a caller-identity or privilege-check mistake, not memory safety or injection. That is the predictable cost of extending a permissions model built for dashboards and saved searches to a layer that acts on a user's behalf. Fixes are shipping inside ordinary patch releases (9.4.5, 9.5.1) rather than as a dedicated hardening effort.
◆Prediction
Expect further Agent Builder advisories as that surface widens, and pressure to consolidate its ownership and privilege checks into one enforcement path instead of patching endpoint by endpoint.

◆Recent moves

  1. 5d ago

    Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

    A Fleet integration policy could declare extra data streams that widened the Elasticsearch API key issued to enrolled Elastic Agents, allowing inserts and mapping extensions beyond intent. Patched in 9.4.5 and 9.5.1 with no workaround for those who cannot upgrade — routine advisory traffic, not a product move.

    View source ↗
  2. 5d ago

    Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)

    Agent Builder compared a stable user identifier only when one was recorded, so private agents could be disclosed or tampered with by other callers. One of four Agent Builder authorization defects in this batch, which is the pattern worth watching rather than the individual CVE.

    View source ↗
  3. 5d ago

    Kibana 9.4.5 Security Update (ESA-2026-97)

    A user-controlled key let callers execute queries against managed hosts they should not reach. Standard patch-release advisory, resolved in 9.4.5.

    View source ↗
  4. 5d ago

    Kibana 9.4.5 Security Update (ESA-2026-89)

    The field-value suggestion helper used when authoring endpoint policy artifacts queried Elastic Defend data without checking the caller's authorization, disclosing endpoint event data. A convenience feature reaching past its caller's permissions — the same shape as the Agent Builder findings.

    View source ↗
  5. 5d ago

    Kibana 9.4.5 Security Update (ESA-2026-82)

    The Agent Builder A2A JSON-RPC endpoint derived a stored conversation's identifier from user-supplied input, permitting unauthorized modification. Fixed in 9.4.5; notable only as further evidence that the agent API surface was shipped ahead of its authorization model.

    View source ↗
  6. 5d ago

    Kibana 9.4.4 Security Update (ESA-2026-83)

    Agent Builder failed to verify that a requesting user held the privileges a separate Kibana feature required before invoking it, enabling privilege escalation and information disclosure. Resolved in 9.4.4 — the earliest of the Agent Builder cluster in this window.

    View source ↗