AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticCVE-2026-72671

Elastic Kibana: missing authorization

Elastic

CVE-2026-72671 · Published Aug 13, 2026 · updated Sep 4, 2026

Medium4.3
No fix yet
Elastic advisory

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 8.0.0, <= 8.19.19No fix yet
>= 9.0.0, <= 9.4.4No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-862

More Elastic advisories

All Elastic