CVE details
CVE-2026-72658
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
Matched ports (5)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/kibana91 | kibana91 | 9.1.10 | unaddressed | elastic@FreeBSD.org |
| textproc/kibana92 | kibana92 | 9.2.8 | unaddressed | elastic@FreeBSD.org |
| textproc/kibana93 | kibana93 | 9.3.8 | possibly backported | elastic@FreeBSD.org |
| textproc/kibana8 | kibana8 | 8.19.21 | fixed by update | elastic@FreeBSD.org |
| textproc/kibana94 | kibana94 | 9.4.7 | fixed by update | elastic@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>kibana91</name>
<range><lt>8.19.20</lt></range>
</package>
<package>
<name>kibana92</name>
<range><lt>8.19.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege
escalation via Cross Site Request Forgery (CAPEC-62). A user who is
permitted to create visualizations can save a specially crafted Vega
visualization that, when it is opened by another user, causes
authenticated requests to be issued to Kibana in the context of the
viewing user's session.</p>
</body>
</description>
<references>
<cvename>CVE-2026-72658</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-72658</url>
</references>
<dates>
<discovery>2026-08-13</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>