CVE-2026-115292

Kibana exposes analytics job messages across spaces

Elastic · Kibana Machine Learning

First documented disclosure · Review checkpoint

Summary

An ML reader in one Kibana space can see diagnostic messages for jobs in another.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: No malicious use is documented in the vendor bulletin. CISA’s November 3 assessment lists exploitation as none.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The data frame analytics message lookup accepts a job key without enforcing the job’s space boundary.

Conditions required

The deployment has multiple spaces and the authenticated caller has Machine Learning read access in at least one.

Potential impact

Job messages can identify destination indexes, analyzed fields and failures in a space the reader cannot access.

Affected versions and configurations

8.0.0–8.19.23, 9.0.0–9.4.8 and 9.5.0–9.5.5, inclusive.

Fix and mitigation status

Elastic verified 8.19.24, 9.4.9 and 9.5.6. Elastic Cloud Serverless was patched before disclosure.

Practical next steps

Upgrade to a release containing the fix on your branch. Elastic lists no workaround.

Operating lesson

Test whether a read-only ML user can retrieve another space’s logs by specifying its job ID.

Evidence and limits

Elastic identifies single-space deployments as unaffected. The advisory describes exposure of job messages and gives no specific compromise indicator.

Sources