CVE-2026-72675 in Kibana
Summary
by MITRE • 08/13/2026
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical authorization flaw classified as CWE-862, where Kibana's machine learning component fails to properly enforce access controls between different user spaces within the Elasticsearch environment. The issue stems from insufficient privilege validation mechanisms that allow unauthorized operations across multiple spaces, creating a significant security risk for organizations relying on Kibana's multi-tenancy features. The flaw specifically affects Kibana's machine learning functionality where internal processes execute with elevated permissions but do not properly apply space-based filtering during Elasticsearch operations.
The technical implementation of this vulnerability occurs through the machine learning subsystem's failure to enforce space isolation boundaries that should normally separate data between different user spaces. When machine learning operations are initiated from one space, the system incorrectly processes these requests against all spaces in the deployment rather than restricting operations to the designated space context. This misconfiguration allows malicious actors or compromised accounts to potentially access and modify machine learning data across multiple tenant environments, effectively bypassing the intended multi-tenancy security model.
The operational impact of this vulnerability extends beyond simple information disclosure to include unauthorized data modification capabilities that could compromise entire deployments. Attackers exploiting this flaw could gain access to sensitive machine learning models, training data, and analytical results from other spaces within the same Kibana instance. This cross-space information disclosure represents a significant escalation from traditional privilege abuse patterns documented in CAPEC-122, where unauthorized users can manipulate data across multiple isolated environments without proper authorization checks.
Organizations should implement immediate mitigations including applying security patches that enforce proper space filtering for all machine learning operations, implementing additional access controls through Elasticsearch role-based permissions, and establishing monitoring for unusual cross-space query patterns. The vulnerability highlights the importance of validating authorization boundaries even within internally trusted components, as demonstrated by the ATT&CK framework's emphasis on privilege escalation techniques and the need for robust internal access control mechanisms. Security teams must also consider implementing network-level restrictions between different Kibana spaces and ensure that all internal system operations properly validate context and scope before executing potentially sensitive operations against shared data stores.