Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse… (CVE-2026-72654)

This vulnerability involves execution with unnecessary privileges (CWE-250) in Kibana's machine learning feature. Specifically, an operation intended for users with read access is performed using an internal service identity rather than the user's identity, enabling privilege abuse (CAPEC-122). As a result, users with only read access to the machine learning feature can receive unauthorized data from Elasticsearch indices. No direct Elasticsearch privileges are needed to exploit this issue.

Users with only read access to the Kibana machine learning feature can gain unauthorized access to data from Elasticsearch indices they normally cannot read. This leads to information disclosure without requiring elevated Elasticsearch cluster or index privileges. The CVSS score of 6.5 reflects a moderate severity with high confidentiality impact but no integrity or availability impact.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict read access to the machine learning feature to trusted users only and monitor for unusual data access patterns related to this feature.