Is CVE-2026-82293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82293 being exploited in the wild.

How severe is CVE-2026-82293?

Medium severity, with a CVSS score of 4.3, published 2 September 2026.

Which products and versions are affected?

Elastic Kibana 8.0.0 to 8.19.20; 9.0.0 to 9.4.5; 9.5.0 to 9.5.1.

Is there a fix for CVE-2026-82293?

A patch was published on 2026-09-02: Patches released in Kibana 8.19.21, 9.4.6, and 9.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82293 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82293?

Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82293: Elastic Kibana authorization bypass in machine learning

CVE-2026-82293 · Severity: medium · CVSS 4.3 · Published 2026-09-02

Kibana, a web-based analytics and search interface used to explore and visualize data stored in Elasticsearch, contains an authorization flaw in its machine learning features. An authenticated user could bypass access controls and invoke machine learning functionality beyond their assigned permissions, consuming cluster resources they should not be able to access and potentially disrupting service availability for other users.

Technologies: Elastic Kibana. Vendors: Elastic.

Quick answers

Is CVE-2026-82293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82293 being exploited in the wild.
How severe is CVE-2026-82293?: Medium severity, with a CVSS score of 4.3, published 2 September 2026.
Which products and versions are affected?: Elastic Kibana 8.0.0 to 8.19.20; 9.0.0 to 9.4.5; 9.5.0 to 9.5.1.
Is there a fix for CVE-2026-82293?: A patch was published on 2026-09-02: Patches released in Kibana 8.19.21, 9.4.6, and 9.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82293 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82293?: Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization flaw (CWE-863) in Kibana's machine learning feature that allows authenticated users to access functionality beyond their authorization scope. The vulnerability exploits incorrectly configured access control security levels (CAPEC-180), allowing an authenticated attacker to consume cluster resources they should not be able to reach. Attack vector is network-based and requires prior authentication; no user interaction is required. The impact is limited to availability (resource exhaustion), with no confidentiality or integrity impact. Patches are available in Kibana versions 8.19.21, 9.4.6, and 9.5.2; no workarounds exist for versions prior to these releases.

Affected products

Elastic Kibana 8.0.0 to 8.19.20; 9.0.0 to 9.4.5; 9.5.0 to 9.5.1

Timeline

2026-09-01: disclosed: Public disclosure via Elastic security advisory ESA-2026-169
2026-09-02: patched: Patches released in Kibana 8.19.21, 9.4.6, and 9.5.2

References

https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-169/390119

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.