CVE-2026-72654

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description The machine learning feature contains an issue where certain operations are executed with an internal service identity instead of the identity of the requesting user. This allows users who only have read access to the machine learning feature to obtain data from Elasticsearch indices for which they lack authorization, without requiring any specific Elasticsearch cluster or index privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.