CVE-2026-82293: Kibana Machine Learning Auth Bypass Flaw

CVE-2026-82293 Overview

CVE-2026-82293 is an Incorrect Authorization vulnerability [CWE-863] affecting the machine learning feature in Elastic Kibana. An authenticated user can invoke machine learning functionality beyond their authorization scope. The flaw maps to Exploiting Incorrectly Configured Access Control Security Levels [CAPEC-180]. Successful abuse consumes cluster resources the user should not be able to reach, degrading availability for legitimate workloads. Elastic addressed the issue in Kibana versions 8.19.21, 9.4.6, and 9.5.2.

Critical Impact
Authenticated low-privilege users can trigger machine learning operations outside their permission scope, leading to unauthorized cluster resource consumption and availability impact.

Affected Products

Elastic Kibana 8.19.x prior to 8.19.21
Elastic Kibana 9.4.x prior to 9.4.6
Elastic Kibana 9.5.x prior to 9.5.2

Discovery Timeline

2026-09-02 - CVE-2026-82293 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82293

Vulnerability Analysis

The vulnerability resides in the Kibana machine learning (ML) feature's authorization logic. Kibana fails to correctly enforce role-based access control when authenticated users invoke ML operations. The result is a broken access control condition where a user's actual privileges diverge from the operations the ML feature will accept and execute against the Elasticsearch cluster.

Because the attack requires only network reachability to Kibana and valid low-privilege credentials, the barrier to exploitation is limited to obtaining any authenticated session. The impact is confined to availability. Confidentiality and integrity of stored data are not affected, but ML jobs and API calls can consume significant CPU, memory, and cluster resources, starving legitimate tenants.

Root Cause

The root cause is an authorization check gap in the Kibana ML feature. The application evaluates request eligibility using an incorrect or incomplete security level, allowing operations to proceed for principals who should be denied. This matches the pattern described in CWE-863: Incorrect Authorization, where the check exists but does not correctly reflect the intended policy.

Attack Vector

An authenticated attacker with low privileges sends requests to Kibana ML endpoints over the network. The requests target ML functionality outside the account's granted role scope. The server accepts and dispatches the requests to the backing Elasticsearch cluster, consuming resources on behalf of the caller. See the Elastic Kibana Security Update for vendor-supplied details.

No verified proof-of-concept code is publicly available. The vulnerability manifests through normal HTTP API interactions with Kibana ML endpoints, not through crafted binary payloads or memory corruption. Refer to the vendor advisory for endpoint-level specifics.

Detection Methods for CVE-2026-82293

Indicators of Compromise

Unexpected ML job creation, starting, or datafeed activity originating from accounts without documented ML responsibilities.
Sudden spikes in Elasticsearch cluster CPU, memory, or task-queue depth correlated with Kibana ML API requests.
HTTP requests to Kibana /api/ml/* paths from user sessions whose assigned roles do not include ML privileges.

Detection Strategies

Correlate Kibana audit logs with Elasticsearch role assignments to flag ML API invocations by principals lacking machine_learning_admin or machine_learning_user roles.
Baseline normal ML job counts, datafeed volume, and per-user API call rates, then alert on deviations.
Ingest Kibana and Elasticsearch audit logs into a centralized analytics platform and build rules that join user identity with the invoked feature.

Monitoring Recommendations

Enable Kibana audit logging and Elasticsearch audit logging with the ML event categories included.
Monitor cluster health metrics for ML node saturation and job queue backlogs.
Track authentication events for accounts that suddenly begin issuing ML API calls after long periods of inactivity in that feature.

How to Mitigate CVE-2026-82293

Immediate Actions Required

Upgrade Kibana to 8.19.21, 9.4.6, or 9.5.2 or later depending on your branch.
Audit all user and API key role mappings and remove ML privileges from accounts that do not require them.
Rotate credentials for any account observed invoking ML functionality outside its documented scope.

Patch Information

Elastic released fixed versions 8.19.21, 9.4.6, and 9.5.2 addressing CVE-2026-82293. Upgrade instructions and full release notes are available in the Elastic Kibana Security Update advisory (ESA-2026-169).

Workarounds

Restrict network access to Kibana so that only trusted user populations can authenticate.
Disable the machine learning feature in kibana.yml by setting xpack.ml.enabled: false where ML is not used operationally.
Apply the principle of least privilege to all Elasticsearch role mappings and remove built-in ML roles from non-ML users until the upgrade is complete.

bash

# Configuration example: disable Kibana ML where not required
# /etc/kibana/kibana.yml
xpack.ml.enabled: false

# Verify no non-ML users retain ML roles
curl -u elastic:$PASS -X GET "https://elasticsearch:9200/_security/role_mapping?pretty"