CVE-2026-72629
Received Received - Intake

Authorization Bypass in Kibana Exposes Model Inference Data

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of inference output from a trained model in a different space that the user is not authorized to list, read, or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and deployment update operations, allowing an active trained model deployment in another space to be stopped or to have its allocated resources altered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72629
EUVD
EUVD-2026-58289

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 8.19.0 (inc) to 8.19.19 (inc)
elastic kibana From 9.0.0 (inc) to 9.4.4 (inc)
elastic kibana 9.5.0
elastic kibana 8.19.20
elastic kibana 9.4.5
elastic kibana 9.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72629 is an authorization bypass vulnerability in Kibana that allows unauthorized cross-space access to machine learning trained models. It occurs due to improper access control, enabling attackers to view inference outputs from models in spaces they are not authorized to access. The vulnerability also permits stopping active model deployments or modifying resource allocations in other spaces.

Detection Guidance

Detecting this vulnerability requires checking Kibana versions for affected releases (8.19.0-8.19.19, 9.0.0-9.4.4, 9.5.0). Use commands like 'curl -XGET http://localhost:5601/api/status' or check version via package manager (e.g., 'dpkg -l | grep kibana' or 'rpm -qa | grep kibana').

Review logs for unauthorized cross-space access attempts or model inference output disclosures. Elastic provides guidance in their security update but no specific detection commands are mentioned.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive machine learning model outputs, potentially exposing confidential or proprietary information. It may also allow attackers to disrupt model deployments by stopping them or altering their resource allocations, impacting system performance and availability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. Exposure of inference outputs or model behavior may result in data breaches, triggering legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Kibana to patched versions (8.19.20, 9.4.5, or 9.5.1) immediately. Elastic Cloud Serverless was already remediated. No workarounds exist for on-premise deployments unable to upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart