CVE-2026-72643 is a critical authorization bypass in Kibana's Agent Builder where ownership is determined by username comparison alone, without realm qualification. In multi-realm Elasticsearch deployments—where you run AD, LDAP, SAML, or native realms simultaneously—two different principals can legitimately share the same username string. The vulnerability lets any principal who shares a username with an agent's true owner instantly gain owner-level access: read, modify, or delete that agent. No credential theft, no injection, no sophistication required. Existence is the only prerequisite.
The dangerous misconception is treating this as a patchable code defect. The reality is worse: the fix changes ownership evaluation rules retroactively across your entire agent corpus, but existing agents carry no metadata indicating which realm their ownership should reference. An agent created under single-realm assumptions now evaluates under multi-realm logic, and the system cannot determine whether a matching username in a different realm is the legitimate owner or an unrelated principal who happens to share that string.
This has three operational consequences. First, patching doesn't resolve existing agents—it's a one-time fix preventing new ones from being created with the defect, while existing ownership remains permanently ambiguous. Second, you cannot safely decommission an authentication realm after deploying this patch. If you remove an LDAP realm, any principal now occupying that username in your remaining realms inherits owner access to agents that may have belonged to a different person. Third, the forensic reality is grim: ownership reassignment overwrites the previous state, leaving no audit trail of what changed or whether agent content was modified during the unpatched window.
Your remediation posture should assume indefinite compromise. Patch immediately, but also audit agent content integrity against out-of-band backups, because a sophisticated attacker wasn't required to exploit this—any user in any realm with a matching username had ambient access, and you may never discover what was changed. If your deployment has never used multiple authentication realms, you're not vulnerable today, but any future realm addition exposes all previously-created agents to this condition retroactively.