{"id":"CVE-2026-115292","kind":"vulnerability","aliases":["CVE-2026-115292"],"related":[],"title":"Kibana: Machine Learning job messages leak across spaces to unauthorized users","description":"Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.","summary":"Kibana's Machine Learning feature lets a user with read access in one space see audit and error messages from data frame analytics jobs in other spaces they are not authorized for. Those messages can reveal destination index names, analyzed field names and failure details.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elasticsearch","kibana","machine-learning","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-ml-jobs","single-space"],"how_to_check":"- Check the Kibana version with `kibana --version` or the `version` field in the server status page\n- Check whether Machine Learning is in use and whether multiple Kibana spaces exist with different access rules","fix":null,"status":"open","published_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:40+00:00","updated_at":"2026-11-03T17:24:40+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T17:24:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kibana: Machine Learning job messages leak across spaces to unauthorized users","impact":"low","summary":"Kibana's Machine Learning feature lets a user with read access in one space see audit and error messages from data frame analytics jobs in other spaces they are not authorized for. Those messages can reveal destination index names, analyzed field names and failure details.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["kibana","elasticsearch","machine-learning","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated users read job messages from other spaces","analyst_note":"Confirm the fixed Kibana versions and the affected version ranges from the Elastic advisory, which the NVD entry does not list.","how_to_check":"- Check the Kibana version with `kibana --version` or the `version` field in the server status page\n- Check whether Machine Learning is in use and whether multiple Kibana spaces exist with different access rules\n- unknown for fixed versions in the sources","plain_action":"","needs_analyst":true,"not_affected_if":["single-space","no-ml-jobs","managed-hosting"],"who_is_affected":"Teams that run self-hosted or managed Kibana with Machine Learning data frame analytics jobs and several spaces with different access rules. An authenticated user with Machine Learning read access in one space can see job messages from other spaces. Deployments with a single space or without Machine Learning jobs are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":4193,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':99C '-115292':14A,17A '-2026':13A,16A '-639':80C 'access':37B,91C,107C,136C 'acl':97C 'across':7A 'analyt':49B,122C 'analyz':66B,148C 'audit':42B,115C 'authent':101C 'author':57B,72C,134C 'belong':125C 'bypass':73C 'capec':98C 'constrain':95C 'control':77C 'cve':12A,15A 'cwe':79C 'data':47B,120C 'destin':63B,145C 'detail':71B,142C 'disclosur':89C 'elasticsearch':18B 'error':44B,117C 'failur':70B,152C 'featur':31B 'field':67B,149C 'frame':48B,121C 'function':92C 'host':26B 'includ':140C 'index':64B,146C 'inform':88C,153C 'job':4A,50B,123C,141C 'key':78C 'kibana':1A,19B,27B,82C,110C 'lead':86C 'leak':6A 'learn':3A,22B,30B,84C,105C 'let':32B 'machin':2A,21B,29B,83C,104C 'machine-learn':20B 'messag':5A,45B,60B,118C,138C 'name':65B,68B,147C,150C 'one':39B,109C 'proper':94C 'read':36B,106C,113C 'reveal':62B 'runtim':23B 'see':41B 'self':25B 'self-host':24B 'space':8A,40B,53B,111C,128C 'unauthor':10A 'user':11A,34B,76C,102C,131C 'user-control':75C 'via':90C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted or managed Kibana with Machine Learning data frame analytics jobs and several spaces with different access rules. An authenticated user with Machine Learning read access in one space can see job messages from other spaces. Deployments with a single space or without Machine Learning jobs are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elasticsearch","kibana","machinelearning","medium","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115292","severity":null,"published_at":"2026-11-03T17:17:55+00:00","modified_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}