---
id: "CVE-2026-115292"
kind: "vulnerability"
aliases: ["CVE-2026-115292"]
title: "Kibana: Machine Learning job messages leak across spaces to unauthorized users"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["elasticsearch", "kibana", "machine-learning", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-ml-jobs", "single-space"]
published_at: "2026-11-03T17:17:55+00:00"
first_seen_at: "2026-11-03T17:21:54+00:00"
updated_at: "2026-11-03T17:24:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115292", "first_seen_at": "2026-11-03T17:21:54+00:00"}]
---

# Kibana: Machine Learning job messages leak across spaces to unauthorized users

Kibana's Machine Learning feature lets a user with read access in one space see audit and error messages from data frame analytics jobs in other spaces they are not authorized for. Those messages can reveal destination index names, analyzed field names and failure details.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kibana version with `kibana --version` or the `version` field in the server status page
- Check whether Machine Learning is in use and whether multiple Kibana spaces exist with different access rules

## Timeline

- 2026-11-03T17:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115292

## From the sources

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_