CVE-2026-72675

Executive Summary

CVE-2026-72675 is an authorization bypass vulnerability in Kibana's Machine Learning (ML) functionality, arising from a missing per-request space filter that should compartmentalize ML data between different Kibana spaces. An authenticated attacker with low-privileged access to one space can read (confidentiality impact: High) and modify (integrity impact: Low) Machine Learning data belonging to all other spaces in the deployment. The vulnerability has a CVSS base score of 7.1, is currently unpatched (patch confidence: 0/4), and there is no public evidence of exploitation or a proof-of-concept.

Technical Analysis

CWE-862 (Missing Authorization) is a vulnerability class where a software component fails to enforce an authorization check on a specific operation or data access path. In the context of this CVE, the flaw exists within Kibana's Machine Learning module.

Kibana is a data visualization and exploration tool that fronts Elasticsearch clusters. It supports multi-tenancy through a concept called "spaces" — logical partitions that separate dashboards, saved objects, and associated data. For Machine Learning, Kibana relies on Elasticsearch's ML API functionality. The NVD description provides the critical mechanism detail: Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another.

This design means that Kibana's ML backend holds credentials/permissions that exceed what the end-user possesses (privilege escalation at the service account level). The isolation is enforced not by Elasticsearch's native document-level security, but by a client-side logical filter that Kibana appends to every ML request, scoping results to the active space.

The vulnerability is that part of the Machine Learning functionality did not apply that filter. Consequently, when a user in Space A issues a particular ML operation (e.g., retrieving job statistics, viewing anomaly results, or querying trained models), that request is forwarded to Elasticsearch without the space-scoping constraint. Elasticsearch sees the request as coming from the elevated internal Kibana ML service account with no space filter, and returns results for ALL spaces in the deployment.

Attack surface specifics based on available details:

• Privilege Required: LOW — the attacker only needs a valid Kibana account able to authenticate and access any ML feature that does not apply the filter.
• Attack Vector: NETWORK — exploitation is carried out over the Kibana HTTP/HTTPS API.
• User Interaction: NONE — the attack is fully automatable via scripting.
• Affected Subsystem: Kibana Machine Learning module — specific API endpoints or functions within ML that invoke Elasticsearch operations are affected, though no exact endpoint names are disclosed in the provided data.

The technical root cause is a TOCTOU-style or fundamental omission in request construction: the ML code paths that were intended to thread a space context variable through to the Elasticsearch client did not do so for a subset of operations. This is a classic "forgotten parameter" bug in multi-tenant authorization frameworks.

Exploitation Scenarios

Important note on evidence: No public PoC exists, no Nuclei template, and no exploit code has been identified. The following attack chain is inferred from the vulnerability class (Missing Authorization) and the precise mechanism disclosed in the NVD description.

Step 1 — Reconnaissance / Target Identification: The attacker identifies a Kibana instance (Shodan dork: Kibana port:5601). They authenticate with any valid low-privileged user account. Because the ML feature needs to be accessible to the user's role, the attacker may need to determine if ML is enabled for their space. Enumeration of available ML features can be done by issuing standard Kibana API requests to discover enabled ML jobs and datafeeds.

Step 2 — Triggering the Flaw: The attacker selects an ML operation that is affected by the missing space filter. Based on the description, this is "part of the Machine Learning functionality" — likely an operation outside the core get/list datafeed or job endpoints, such as: statistics retrieval, forecast APIs, calendar/event queries, or model snapshot operations. From their authenticated context, the attacker issues the request to their own space's ML endpoint. Since the space filter is missing, the backend proxy forwards the request to Elasticsearch without scoping.

Step 3 — Payload / Execution Method: At the vulnerability-class level, this is an authorization check bypass. The "payload" is the API request itself (HTTP method + path + query parameters). Because the internal Kibana->Elasticsearch authentication uses elevated permissions, the attacker inherits those elevated permissions for the un-filtered operation. The attacker can iterate through ML job IDs, model IDs, or space names to dump data. The impact distinguishes: Read (High confidentiality) — bulk extraction of ML data across all spaces; Write (Low integrity) — potential modification of ML configuration if the affected operation includes update/delete semantics.

Step 4 — Post-Exploitation Impact: The attacker now has:

• Cross-space information disclosure: ML data (anomaly scores, model weights, original indexed data referenced by datafeeds) from every space in the deployment.
• Unauthorized data modification: Depending on which ML API is vulnerable, the attacker may be able to alter job definitions, suppress anomalies, or corrupt model state — causing integrity compromise of ML-driven security monitoring or operational analytics.
• Potential lateral movement within the Kibana data plane: While the attacker does not gain direct Elasticsearch query access, the ML data may contain sensitive business or security information that enables further attacks.

Impact Assessment

Business Impact:

• Confidentiality (High per CVSS): Machine Learning data is inherently derived from source data — typically including security events, financial transactions, operational metrics, and user behavior. Cross-space disclosure breaches tenant isolation SLAs and may violate data protection regulations (GDPR, HIPAA, PCI-DSS) if the ML data contains PII or payment data.
• Integrity (Low per CVSS): Unauthorized modification of ML models/jobs could allow an attacker to corrupt anomaly detection — potentially hiding malicious activity (if ML is used for security) or skewing business analytics.
• Availability (None): The vulnerability does not directly threaten service availability.

Affected Systems:

• Any Elastic Stack deployment with Kibana ML enabled and multi-space configurations (default in Kibana when spaces are enabled). The vulnerability is particularly severe in shared Kibana deployments serving multiple tenants/departments. Affected version range is unknown at this time (empty Affected Versions field in provided data).

Blast Radius:

• All spaces in a single Kibana deployment. The vulnerability does not cross deployment boundaries (Elasticsearch clusters). However, within a deployment, every space's ML data is exposed to any authenticated low-privileged user who can access ML features.

CVSS Subscore Rationale:

• AV:N/AC:L — remotely exploitable without special conditions.
• PR:L — requires only low-privileged authenticated access.
• S:U — scope unchanged (privileges do not cross trust boundaries like containers/VMs).
• C:H/I:L/A:N — the confidentiality damage is severe (bulk data theft), integrity damage is limited to ML-specific data.

Detection Guidance

The following detections aim at identifying anomalous access to Kibana ML APIs, particularly from low-privileged accounts or involving unusual space-scoping behavior. Note: because the attack is API-level, detection relies on auditing Kibana and Elasticsearch audit logs, and network-level monitoring for unusual ML API call volume.

Sigma Rule

title: Suspicious Kibana Machine Learning API Access - Potential CVE-2026-72675
id: 402b5c8f-9e47-4a76-9f4d-6c9ab1e2f8d3
status: experimental
description: Detects a high volume or anomalous pattern of Kibana ML API requests from a low-privilege user, potentially indicating cross-space authorization bypass (CVE-2026-72675).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72675
author: valtersit.com Threat Intel
date: 2026/05/20
logsource:
    category: web
    product: kibana
detection:
    selection:
        http.url|contains:
            - '/api/ml/'
            - '/internal/ml/'
    filter_known_high_privileges:
        user.roles|contains:
            - 'superuser'
            - 'kibana_admin'
    condition: selection and not filter_known_high_privileges
    timeframe: 5m
level: high
falsepositives:
    - Legitimate ML dashboard usage by data analysts with restricted roles in small deployments
tags:
    - attack.discovery
    - attack.collection
    - cve.2026.72675

YARA Rule

rule CVE_2026_72675_Kibana_ML_Auth_Bypass {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detection of requests attempting to access Kibana ML endpoints with insufficient space scoping"
        cve = "CVE-2026-72675"
        date = "2026-05-20"
        severity = "high"
    strings:
        $s1 = "/api/ml/" ascii wide nocase
        $s2 = "/_ml/" ascii wide nocase
        $s3 = "get_ml_info" ascii wide nocase
        $s4 = "ml/jobs" ascii wide nocase
        $s5 = "space" ascii wide nocase
    condition:
        all of ($s1, $s2) or (any of ($s1, $s2, $s3, $s4) and #s5 < 3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Kibana ML Cross-Space Authorization Bypass (CVE-2026-72675)"; flow:to_server,established; content:"GET"; http_method; content:"/api/ml/"; http_uri; content:"/"; http_uri; distance:1; content:"HTTP/1.1"; http_protocol; threshold:type both, track by_src, count 30, seconds 60; metadata:created_at 2026_05_20, updated_at 2026_05_20, former_category CURRENT_EVENTS, cve CVE-2026-72675, mitre_tactic_id TA0009, mitre_tactic_name Collection; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72675; sid:30000127; rev:1;)

Elastic Detection

sequence by user.id, source.ip
  with maxspan=5m
  [ any where event.dataset == "kibana.audit" and
    (kibana.audit.type == "http_request" or event.action == "http_request") and
    (url.path == "/api/ml/*" or url.path == "/internal/ml/*") and
    not user.roles : ("superuser", "kibana_admin") ]
  [ any where event.dataset == "kibana.audit" and
    (kibana.audit.type == "http_request" or event.action == "http_request") and
    (url.path == "/api/ml/*" or url.path == "/internal/ml/*") and
    not user.roles : ("superuser", "kibana_admin") ]

Splunk SPL Query

index=kibana earliest=-24h
  (sourcetype="kibana:audit" OR sourcetype="kibana:server")
  [search index=kibana sourcetype="kibana:audit" role!="superuser" role!="kibana_admin"
    | stats count by user, src_ip
    | where count > 10
    | fields user src_ip]
  | search url="/api/ml/*" OR url="/internal/ml/*"
  | stats count by user, src_ip, url, _time
  | sort - count

Wazuh OSSEC Rule

<group name="kibana,">
  <rule id="100327" level="12" frequency="15" timeframe="60">
    <if_matched_sid>100326</if_matched_sid>
    <field name="url">\./api/ml/\.|\./internal/ml/\.</field>
    <description>Potential Kibana ML cross-space auth bypass (CVE-2026-72675) - high volume from single user</description>
    <group>access_control,exploit,kibana,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (Patch Confidence: 0/4). No vendor patch, hotfix, or mitigation has been released from any tracked source. The Affected Versions field is empty, meaning the full scope of affected versions is not yet publicly disclosed.

1. Immediate Mitigations (until patch available):

• Disable Machine Learning for all non-admin spaces if ML is not business-critical. This can be done in Kibana advanced settings (ML enabled flag) or by restricting user role permissions that grant ML access.
• Implement role-based access control (RBAC) hardening: Remove machine_learning_user and machine_learning_admin cluster privileges from low-trust users. Only grant ML access to dedicated admin users in single-purpose spaces.
• Network segmentation: Restrict access to Kibana's ML API endpoints via reverse proxy rules (e.g., block /api/ml/ for networks/user groups that do not require ML).
• Enable Elasticsearch audit logging for ML indices (.ml-* index prefix) and monitor for cross-space access patterns.
• Monitor closely: Apply the detection rules above to identify suspicious ML API usage.

2. Patch/Upgrade Steps:

• Monitor the Elastic Security advisory feed (https://www.elastic.co/community/security) and the NVD entry for updates.
• When an advisories is published, upgrade to the patched Kibana version immediately. As part of the upgrade, verify the ML space filter is applied in the affected code paths.
• Subscribe to Elastic's mailing list for pre-release security notifications.

3. Long-Term Hardening:

• Reduce reliance on client-side filters: Kibana's use of an internal elevated service account for ML — with filtering handled at the application layer — is architecturally fragile. Long-term, Elastic should migrate to Elasticsearch-native field/space-level security (e.g., DLS/FLS) so that space isolation is enforced server-side even if Kibana omits the filter.
• Audit all similar multi-tenant features in Kibana (e.g., reporting, saved objects, alerts) for the same missing-filter pattern.
• Run Kibana in least-privilege configuration: ensure the internal ML service account is scoped to only the ML indices, and restrict ML cluster privileges where possible.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72675
2. Elastic Security Advisories: https://www.elastic.co/community/security (monitor for upcoming advisory relating to CVE-2026-72675)
3. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. CAPEC-122 — Privilege Abuse: https://capec.mitre.org/data/definitions/122.html
5. MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

Threat Actor Campaigns / Exploit-in-the-Wild: No known exploitation campaigns have been detected as of this report. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score has not yet been calculated by FIRST. No PoC or exploit code has been published in public repositories. The lack of patch and the moderate complexity of the attack (requires authenticated access + knowledge of ML API structure) suggest that early exploitation is unlikely but possible in targeted attacks against multi-tenant environments.