CVE-2026-72654: CWE-250 Execution with Unnecessary Privileges in Elastic Kibana

This vulnerability in Kibana's machine learning feature allows users with read-only access to receive data from Elasticsearch indices they are not authorized to access. The issue arises because an operation is performed with an internal service identity rather than the identity of the requesting user, enabling privilege abuse (CAPEC-122). No additional Elasticsearch privileges are needed to exploit this flaw. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity and low privileges required, resulting in high confidentiality impact but no integrity or availability impact. No patch or official remediation is currently documented.

An attacker with read access to the machine learning feature in Kibana can obtain unauthorized access to sensitive data from Elasticsearch indices that they should not be able to read. This leads to information disclosure without requiring elevated Elasticsearch privileges. There is no impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict read access to the machine learning feature to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary read privileges to reduce exposure.