CVE-2026-78598: Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data
Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without holding access rights to those additional spaces.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have machine learning job management privileges in at least one Kibana space. No user interaction is required.
What is exposed if exploitation succeeds?
A machine learning job's saved object can become accessible across all spaces in the Kibana instance. This can disclose job data to users who do not have rights to the additional spaces.
Are users without machine learning job management privileges able to trigger the issue?
The described exploitation requires machine learning job management privileges within a single Kibana space. The available information does not indicate that unauthenticated users or users lacking those privileges can trigger it.