EUVD-2026-69567

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654

CVE-2026-72654 is an Execution with Unnecessary Privileges (CWE-250) vulnerability in the Kibana machine learning feature . An operation available to users with only read access to the ML feature was executed using an internal service identity rather than the requesting user's own identity, allow...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72649

This CVE affects the Elasticsearch machine learning component , where a deserialization of untrusted data flaw (CWE-502) via object injection (CAPEC-586) permits remote code execution . A specially crafted trained model artifact can cause attacker-controlled logic to execute with a materially bro...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause...

awesome-ai-security — Updated!

awesome-ai-security A curated list of AI Security materials and resources for Pentesters, Bug Hunters, and Security Researchers. root@kitploit: If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the...

PT-2026-84390

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72649: Deserialization of Untrusted Data

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72654: Execution with Unnecessary Privileges

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-82833

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component...

CVE-2026-82834: Improper Access Control

A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. This affects the function LabelList of the file /v1/projects/1/category-types of the component...

Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-92 / ESA-2026-98 / ESA-2026-100 / ESA-2026-104 / ESA-2026-105 / ESA-2026-106 / ESA-2026-110)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-92, ESA-2026-98, ESA-2026-100, ESA-2026-104, ESA-2026-105, ESA-2026-106 and ESA-2026-110 advisories. - Missing...

BIT-KIBANA-2026-72675 Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification

Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122. Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to...

BIT-KIBANA-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...