Threats Tagged 'bit-elk-2026-72671'

Kibana contains a vulnerability in its Machine Learning capability where insufficient authorization checks allow users with privileges to create anomaly detection and data frame analytics jobs—but without trained model privileges—to remove trained machine learning models from a space. The trained model itself is not deleted and remains accessible in other spaces. This modification can be reversed by users with appropriate privileges. The issue affects Kibana versions from 8.0.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.