Kibana CVE-2026-63145

Exploitation requires an authenticated Kibana user who has been granted Machine Learning access in at least one Kibana space - this is the only prerequisite beyond network access to the Kibana instance. The vulnerability is present in default Kibana ML configurations and does not require any special non-default setting to be enabled. Exploitation is constrained to the integrity of ML audit and notification records; the attacker cannot read data from other spaces (no confidentiality impact) and cannot affect system availability. The CVSS PR:L confirms a low but non-zero privilege requirement - unauthenticated exploitation is not possible. The scope is also limited to users and deployments where the Machine Learning feature is licensed and in use; Kibana deployments with ML entirely disabled or unlicensed are not affected.

The CVSS 4.3 (Medium) rating aligns well with actual risk signals. The vector AV:N/AC:L/PR:L/UI:N reflects that any authenticated low-privilege ML user can reach the endpoint over the network without complexity barriers, but S:U and I:L correctly bound the blast radius to integrity of ML audit and notification records only - no confidentiality exposure and no availability impact. There is no CISA KEV listing and no POC code identified, indicating no public or confirmed active exploitation at this time. The EPSS score is not provided in the available data, so exploitation probability cannot be quantified. The real-world priority should be moderate: organizations running multi-tenant Kibana deployments with multiple users holding ML access in different spaces face the highest risk, since an attacker in one space could tamper with another space's audit trail. Single-tenant or tightly access-controlled deployments have limited exposure. The absence of confidentiality impact makes this a data integrity concern rather than a data breach vector.

An authenticated Kibana user with low-level Machine Learning access in Space A crafts requests to the ML management endpoint targeting ML job or notification resource IDs belonging to Space B or another user. Because the endpoint only checks that the requestor has some ML privilege and does not validate resource ownership, Kibana uses its elevated internal credentials to write the attacker-controlled data to restricted ML system indices. The attacker can thereby corrupt or falsify ML audit logs and notification records for jobs they have no legitimate access to.