Description

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T20:17:27.653Z",
  "pubdate": "2026-08-13T20:17:27.653Z",
  "executiveSummary": "A privilege enforcement vulnerability exists within the Kibana Machine Learning capability responsible for removing saved objects from the current space.\nThe vulnerability allows an authenticated user with restricted privileges to remove trained machine learning models from a specific space, bypassing the intended authorization checks for trained model management.\nThe affected product is Kibana, specifically its Machine Learning saved object management functionality.\nThe risk implications involve unauthorized modification of workspace resources and disruption of machine learning services within affected spaces, although the global model asset is not permanently destroyed.\nAn attacker must possess credentials and specific baseline roles granting the creation of anomaly detection jobs and data frame analytics jobs, but lacking explicit trained model privileges.\nExploitation results in the removal of the targeted trained model object from the current space, though the core model data remains intact in other spaces and the action is reversible by a privileged administrator.",
  "technicalDetails": "The root cause of the vulnerability stems from incomplete authorization checks within the Kibana Machine Learning saved object deletion mechanism.\nWhen a request is processed to remove a saved object from the current space, the endpoint accepts machine learning trained models as a valid target parameter.\nHowever, the validation logic exclusively verifies privileges associated with anomaly detection jobs and data frame analytics jobs, failing to validate whether the actor holds the specific privilege required for trained model management.\nConsequently, an authenticated user whose assigned role permits the creation of anomaly detection jobs and data frame analytics jobs—while omitting trained model privileges—can successfully invoke the deletion routine against trained model saved objects within a shared space.\nThe step-by-step attack flow involves an authenticated user interacting with the Kibana Machine Learning capability API or interface to target a trained model saved object within the current space.\nThe backend authorization module evaluates the user's role against anomaly detection and data frame analytics constraints rather than trained model authorization parameters.\nUpon passing these insufficient validation checks, the endpoint executes the removal of the trained model saved object from the designated space.\nPost-exploitation impact is limited to the local space context; the underlying model itself is not permanently deleted from the underlying storage layer, remains accessible within other spaces, and the space-level deletion can be reversed by a suitably privileged user."
}