Kibana EUVD-2026-70059

Exploitation requires: (1) a valid authenticated Kibana account - unauthenticated access is not possible (PR:L in CVSS vector confirms this); (2) the account must hold ML job management privileges within at least one Kibana Space; (3) the target Kibana instance must use the Spaces feature with multiple Spaces configured, and those Spaces must be intended to enforce access segregation between users. Deployments using a single Space or where all users share equivalent permissions gain no meaningful additional exposure from this flaw. The vulnerability is limited to the Kibana machine learning saved object handling path; Elasticsearch, Logstash, and other Elastic Stack components are not in scope. Integrity impact (I:L) reflects that the saved object's Space association can be modified, not that arbitrary data can be written.

The CVSS 5.4 Medium rating is consistent with the realistic threat model. Exploitation is constrained by the PR:L requirement - the attacker must already hold an authenticated account with ML job management privileges in at least one Space, ruling out external or unauthenticated attack paths. The resulting impact is bounded: confidentiality and integrity are each rated Low (C:L/I:L), reflecting access to ML job saved object data rather than full Kibana data exfiltration or system compromise. No KEV listing exists and no public exploit code is available, and no EPSS score is present in the provided intelligence. The attack surface is most meaningful in multi-tenant Kibana deployments where Spaces are relied upon as a hard security boundary between teams with different data-sensitivity clearances - in single-team or flat-permission environments, the cross-space disclosure is largely academic. The absence of availability impact (A:N) confirms this is a data-exposure flaw, not a denial-of-service or destructive vector. Overall, this warrants prompt patching in environments using Spaces-based access segregation, but is not a critical emergency for organizations without strict cross-team isolation requirements.

An analyst account with ML job management rights in a restricted Kibana Space performs a specific job configuration operation that causes the job's saved object to propagate across all Spaces in the instance. The analyst can then read ML job metadata, configurations, or results belonging to other teams in separate Spaces - such as a security analytics team's threat-detection model outputs - without having been granted access to those Spaces. No public exploit code is known at time of analysis.