CVE-2026-72654: Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Kibana users who have read access to the machine learning feature are the relevant threat actors. They do not need any Elasticsearch cluster or index privileges to potentially obtain data from indices they are not authorized to read.
What access does an attacker need to exploit it?
The attacker needs only read-level access to Kibana's machine learning feature. The affected operation is executed using an internal service identity rather than the requesting user's identity.
What data could be exposed?
The issue can disclose data from Elasticsearch indices that the requesting user is not authorized to read. The provided information does not identify specific index types or data fields.