Description
Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | 8.0.0 – ≤ 8.19.20, 9.0.0 – ≤ 9.4.5, 9.5.0 – ≤ 9.5.1 | — |
Advisories 1
- WID-SEC-2026-3145 Kibana: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026