Missing Authorization in Kibana - CVE-2026-72671

Vulnerability details

The vulnerability allows a remote user to modify machine learning trained model space assignments.

The vulnerability exists due to missing authorization in a Kibana Machine Learning capability that removes a saved object from the current space when handling requests to remove trained models from a space. A remote user can remove a trained model from a space to modify machine learning trained model space assignments.

Only Kibana deployments with the Machine Learning feature enabled are vulnerable. Exploitation requires a custom role that grants privileges to create anomaly detection jobs and data frame analytics jobs without granting the trained model privilege.

Affected software

How to mitigate CVE-2026-72671

External References

• https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-88/389525

Related Security Bulletins

• Multiple vulnerabilities in Kibana