Kibana ML Missing Authorization in Space Model Assignments (CVE-2026-72671)

Vulnerability Overview Title: Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments Description: Kibana's machine learning functionality allows users to save objects within the current space, but it only validates permissions for anomaly detection jobs and data visualizations. If a user's role is granted permissions to create anomaly detection jobs and data visualizations but lacks permissions to create trained models, they can remove trained models from the space. The models themselves are not deleted; rather, they remain in other spaces and can be restored by users with appropriate privileges. Affected Versions Affected Versions: All versions up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configuration: Kibana deployments running an affected version with the Machine Learning feature enabled. Exploitation requires a authenticated Kibana user whose role grants permissions to create anomaly detection jobs and data visualizations, but does not grant permissions to create trained models. Since the Kibana Role Management UI does not generate this specific combination of permissions, exploitation relies on custom role assignments. Remediation Solutions and Mitigations: The issue has been resolved in versions 8.19.20 and 9.4.5. For users unable to upgrade: There are no workarounds. Additional Information: Severity: CVSSv3.1: Medium (4.3) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE ID: CVE-2026-72671 Vulnerability Type: CWE-862 - Missing Authorization Related Topics Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92) Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126) Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-69) Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-72) Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-67) Page Metadata Author: Ioannis Kakavas (Elastic Team Member) Published: 12h ago Tags: Announcements, Security Announcements Views: 58 views Replies: 0 replies Footer Information Copyright: © 2020, All Rights Reserved - Elasticsearch Trademarks: Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries. Other Trademarks: Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS, and the yellow elephant logo are trademarks of the Apache Software Foundation.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana ML Missing Authorization in Space Model Assignments (CVE-2026-72671)