CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
Users with read-only access to Kibana machine learning can access unauthorized Elasticsearch data due to improper privilege handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72654?
CVE-2026-72654 is a medium-severity vulnerability in Elastic Kibana, published on 1 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch indices they are not authorized to read. No Elasticsearch cluster or index privileges are required.
Weakness: CWE-250
Which versions are affected by CVE-2026-72654?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-72654?
Apply the vendor's patch.
Is CVE-2026-72654 being exploited?
There is no known exploitation of CVE-2026-72654 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-g5v5-hvmc-hhx2, MINI-48g2-4wcf-69mg, MINI-8h5r-8f8q-84xx, MINI-fq8f-x4mp-29mr, MINI-hh4h-r6vq-3g2r, MINI-j948-hrp8-h286 and 3 more.