CVE-2026-72654 Overview
CVE-2026-72654 is an information disclosure vulnerability in Elastic Kibana's machine learning feature. An operation available to users holding only read access to the machine learning feature was executed with an internal service identity instead of the requesting user's identity. This allowed low-privileged Kibana users to receive data from Elasticsearch indices they were not authorized to read. The flaw is categorized as Execution with Unnecessary Privileges [CWE-250] and maps to Privilege Abuse [CAPEC-122]. No Elasticsearch cluster or index privileges are required to exploit the issue.
Critical Impact
Authenticated Kibana users with read-only access to machine learning can retrieve data from Elasticsearch indices outside their authorization scope, resulting in confidentiality loss.
Affected Products
- Elastic Kibana 8.x prior to 8.19.21
- Elastic Kibana 9.x prior to 9.4.6
- Elastic Kibana 9.5.x prior to 9.5.2
Discovery Timeline
- 2026-09-01 - CVE-2026-72654 published to NVD
- 2026-09-02 - Last updated in NVD database
- ESA-2026-135 - Elastic releases security advisory and fixed versions
Technical Details for CVE-2026-72654
Vulnerability Analysis
The vulnerability originates in Kibana's machine learning feature. A backend operation reachable by users with only the read privilege to the machine learning application executed under an internal service account rather than the caller's identity. This design flaw disconnects Kibana's application-level authorization from Elasticsearch's index-level authorization model. Because the service identity typically carries broader index read access, the operation returned document data from indices the requesting user should not see. Exploitation requires an authenticated Kibana session but does not require any Elasticsearch cluster or index privileges on the target data, which materially expands the exposure surface within multi-tenant deployments.
Root Cause
The root cause is Execution with Unnecessary Privileges [CWE-250]. The affected code path invoked Elasticsearch APIs using an internal service identity instead of propagating the requesting user's identity. Authorization checks at the Kibana feature level were satisfied by the user's machine learning read role, but no downstream check was performed against the user's Elasticsearch index privileges.
Attack Vector
The attack vector is network-based and requires authenticated low-privileged access. An attacker with a Kibana account granted only the machine learning read privilege issues requests against the affected machine learning operation. The backend then reads Elasticsearch index data using elevated service credentials and returns content the user is not entitled to view. No user interaction is required, and no changes to cluster or index permissions are needed. See the Elastic Security Update ESA-2026-135 for vendor-provided technical detail.
Detection Methods for CVE-2026-72654
Indicators of Compromise
- Kibana audit log entries showing machine learning API calls from users whose roles do not grant access to the underlying Elasticsearch indices returned in responses.
- Elasticsearch access logs showing index reads attributed to the Kibana internal service account that correlate in time with machine learning feature requests from low-privileged users.
- Anomalous volume of machine learning read operations from accounts that historically do not use ML functionality.
Detection Strategies
- Enable Kibana audit logging and cross-reference event.action entries for machine learning routes against the requesting user's Elasticsearch role mappings.
- Compare user role assignments against indices touched during ML operations to identify mismatches indicative of privilege abuse.
- Alert when a Kibana user with only read on the ML feature triggers backend calls that resolve data from indices outside their assigned space or role.
Monitoring Recommendations
- Forward Kibana and Elasticsearch audit logs to a centralized analytics platform and retain them for post-incident review.
- Baseline normal machine learning feature usage per user and role, then alert on deviations.
- Review role definitions for accounts granted machine_learning_user or equivalent read scopes and confirm they are intended.
How to Mitigate CVE-2026-72654
Immediate Actions Required
- Upgrade Kibana to a fixed version: 8.19.21, 9.4.6, or 9.5.2 as applicable to your deployment track.
- Audit all Kibana users and API keys with read access to the machine learning feature and remove unnecessary grants.
- Review Elasticsearch audit logs since the affected versions were deployed to identify prior data exposure.
Patch Information
Elastic published fixes in Kibana 8.19.21, 9.4.6, and 9.5.2. Refer to the Elastic Security Update ESA-2026-135 for the complete list of fixed versions, upgrade guidance, and vendor acknowledgements. Patched builds correctly execute the affected machine learning operation under the requesting user's identity so Elasticsearch enforces index-level authorization.
Workarounds
- Remove the machine learning feature read privilege from users who do not require it until patches are applied.
- Restrict network access to Kibana to trusted administrators where operationally feasible.
- Segment sensitive indices onto separate Elasticsearch clusters that do not share a Kibana instance with lower-trust users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
