CVE-2026-72675

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Missing authorization in Kibana Machine Learning allows for cross-space information disclosure and unauthorized data modification. The system performs Elasticsearch operations using elevated internal permissions and depends on a per-request space filter to isolate machine learning data between different spaces. Because certain Machine Learning functionalities fail to apply this filter, operations initiated from one space can affect the machine learning data across all spaces in the deployment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.