CVE-2026-82293 Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-82293 Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

EUVD-2026-70067

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user could invoke machine learning functionality beyond their authorization scope,...

CVE-2026-82293

Kibana's machine learning feature is affected by an Incorrect Authorization flaw (CWE-863) that allows an authenticated user to invoke machine learning functionality beyond their authorization scope, leading to unauthorized cluster resource consumption with low availability impact. The vulnerabil...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598 Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78598

CVE-2026-78598 is an Incorrect Authorization (CWE-863) flaw in the Kibana machine learning feature. An authenticated user with machine learning job management privileges in a single Kibana space can cause a job's saved object to become accessible across all spaces in the instance, exposing data t...

EUVD-2026-70059

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

PT-2026-84748

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Incorrect Authorization in the machine learning feature allows an authenticated user to invoke functionality beyond their authorized scope. This can lead to unauthorized resource consumption o...

PT-2026-84736

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-169)

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)

Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An...

CVE-2026-72654

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72649

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

EUVD-2026-69567

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654

CVE-2026-72654 is an Execution with Unnecessary Privileges (CWE-250) vulnerability in the Kibana machine learning feature . An operation available to users with only read access to the ML feature was executed using an internal service identity rather than the requesting user's own identity, allow...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...