Improper Privilege Management in Kibana by Elastic

CVE-2026-72671

What is CVE-2026-72671?

A vulnerability exists in the Kibana Machine Learning feature where insufficient privilege checks allow users with roles that permit the creation of anomaly detection jobs and data frame analytics jobs to remove trained models from their current space. Although this action does not delete the models themselves, which remain accessible in other spaces, it can lead to unauthorized modifications. The situation can be reversed only by users with adequate privileges, creating potential security risks within the application's environment.

References