Live › vulnerability › CVE-2026-115292
Kibana's Machine Learning feature lets a user with read access in one space see audit and error messages from data frame analytics jobs in other spaces they are not authorized for. Those messages can reveal destination index names, analyzed field names and failure details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams that run self-hosted or managed Kibana with Machine Learning data frame analytics jobs and several spaces with different access rules. An authenticated user with Machine Learning read access in one space can see job messages from other spaces. Deployments with a single space or without Machine Learning jobs are not exposed.
No product ranges from the sources yet.
kibana --version or the version field in the server status pageNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.
This page as .md · .json · in your agent: get_signal("CVE-2026-115292")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.