CVE-2026-63145
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An incorrect authorization vulnerability in Kibana's Machine Learning functionality allows low-privileged users to manipulate ML audit and notification records for arbitrary jobs across spaces using internally elevated credentials.
Risk Assessment
An attacker could compromise the integrity of ML records, potentially hiding unauthorized actions or manipulating machine learning outcomes.
Recommendation
Apply the Kibana update that fixes authorization checks for ML management endpoints.
Other vulnerabilities in Kibana
See all- CVE-2017-8452High
Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.
- CVE-2016-1000219High
Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.
- CVE-2019-7609CriticalActively exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.
- CVE-2026-102412Medium
Incorrect authorization in Kibana can lead to disclosure of sensitive information. An authenticated user with limited Fleet privileges could access credential material restricted to Fleet administrators. Exploitation may allow theft of cryptographic keys and impersonation of trusted Fleet infrastructure components.
- CVE-2026-102410Medium
Missing authorization in Kibana's Metrics Experience feature allows a user with only data-store-level read access to retrieve index-derived metric data through Kibana, despite lacking the corresponding Kibana feature privilege. A related API enforced authorization, but this internal API did not.
- CVE-2026-102406High
Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.
- CVE-2026-94400Medium
Uncontrolled resource consumption (CWE-400) in Kibana can lead to denial of service via excessive allocation (CAPEC-130).
- CVE-2026-78582Medium
Missing authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via exploiting incorrectly configured access control security levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.
- CVE-2026-72662Medium
A vulnerability in Kibana allows authorization bypass through a user-controlled key (CWE-639). An authenticated user with the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.
- CVE-2026-82302High
Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS