CVE-2026-72671
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A Kibana Machine Learning capability that removes a saved object from the current space accepts trained models as a target, but only verifies privileges for anomaly detection and data frame analytics jobs. A user with those job creation privileges but without trained model privilege can remove a trained model from a space. The model is not deleted and remains in other spaces, and the change can be reversed by a privileged user.
Risk Assessment
Unauthorized removal of a model from a space can disrupt ML functionality in that space, but does not cause permanent data loss. Risk is moderate but requires privilege adjustment.
Recommendation
Update Kibana to the patched version. Adjust roles so users without model privileges cannot remove models.
Original NVD description (English source)
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.