CVE-2026-63145: Kibana Machine Learning endpoint lets users alter audit and notification records

Summary

CVE-2026-63145 is an Incorrect Authorization flaw (CWE-863) in Kibana's Machine Learning functionality. A Machine Learning management endpoint checks only a coarse privilege level and does not verify access to the specific job or notification resources in the request. A low-privileged user with Machine Learning access in any Kibana space can therefore alter audit and notification records for arbitrary jobs, including jobs in other spaces or owned by other users, by using Kibana's internally elevated credentials to write to restricted Machine Learning system indices.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database
• MediumAI found Linux kernel bugs that remained undetected for decadesSimilar attack · CSO Online
• InfoInside an AI Attack Against a US RetailerSimilar attack · Dark Reading
• HighCVE-2026-67547: taOS remote code execution via skill-exec endpoint for non-admin usersSimilar attack · NVD/CVE Database
• MediumCVE-2026-65957: Helio dashboard CORS origin validation bypass via private-network prefix matchSimilar attack · NVD/CVE Database