CVE-2026-82293 PUBLISHED

Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption

Assigner: elastic
Reserved: 28.08.2026 Published: 02.09.2026 Updated: 02.09.2026

Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke machine learning functionality beyond their authorization scope, consuming cluster resources they should not be able to reach.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Elastic
Product	Kibana
Versions	Default: unaffected affected from 8.0.0 to 8.19.20 (incl.) affected from 9.0.0 to 9.4.5 (incl.) affected from 9.5.0 to 9.5.1 (incl.)

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119

Problem Types

CWE-863 Incorrect Authorization CWE

Impacts

CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels