Elk: Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models (CVE-2026-72629)
CVE-2026-72629 is a high-severity authorization bypass vulnerability in Kibana that allows unauthorized cross-space access to machine learning trained models. The flaw arises from improper access control checks on a user-controlled key, enabling attackers to view inference outputs from models in spaces they are not authorized to access. Additionally, attackers can stop or update active model deployments in other spaces, potentially disrupting operations or altering resource allocation. This vulnerability affects specific Kibana versions from 8.19.0 up to but not including 8.19.20, 9.0.0 up to but not including 9.4.5, and 9.5.0 up to but not including 9.5.1. A patch is available to address this issue.
AI Analysis
Technical Summary
The vulnerability CVE-2026-72629 in Kibana involves an authorization bypass through a user-controlled key, classified under CWE-639. This bypass allows unauthorized users to access machine learning trained models across different spaces by exploiting insufficient access control enforcement (CAPEC-1). The unauthorized access includes disclosure of inference outputs from models in other spaces and the ability to stop or update active model deployments, affecting confidentiality and availability of machine learning resources. The issue impacts Kibana versions >=8.19.0 <8.19.20, >=9.0.0 <9.4.5, and >=9.5.0 <9.5.1. The vulnerability has been assigned a high severity rating and a patch is available to remediate the issue.
Potential Impact
Exploitation of this vulnerability allows an attacker to bypass authorization controls and gain unauthorized access to machine learning model outputs and management operations in Kibana spaces they should not access. This leads to disclosure of sensitive inference data and potential disruption or manipulation of active model deployments, impacting confidentiality and availability of machine learning services.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.20 or later, 9.4.5 or later, and 9.5.1 or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official fix.
Elk: Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models (CVE-2026-72629)
Description
CVE-2026-72629 is a high-severity authorization bypass vulnerability in Kibana that allows unauthorized cross-space access to machine learning trained models. The flaw arises from improper access control checks on a user-controlled key, enabling attackers to view inference outputs from models in spaces they are not authorized to access. Additionally, attackers can stop or update active model deployments in other spaces, potentially disrupting operations or altering resource allocation. This vulnerability affects specific Kibana versions from 8.19.0 up to but not including 8.19.20, 9.0.0 up to but not including 9.4.5, and 9.5.0 up to but not including 9.5.1. A patch is available to address this issue.
Affected software
pkg:bitnami/kibanaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-72629 in Kibana involves an authorization bypass through a user-controlled key, classified under CWE-639. This bypass allows unauthorized users to access machine learning trained models across different spaces by exploiting insufficient access control enforcement (CAPEC-1). The unauthorized access includes disclosure of inference outputs from models in other spaces and the ability to stop or update active model deployments, affecting confidentiality and availability of machine learning resources. The issue impacts Kibana versions >=8.19.0 <8.19.20, >=9.0.0 <9.4.5, and >=9.5.0 <9.5.1. The vulnerability has been assigned a high severity rating and a patch is available to remediate the issue.
Potential Impact
Exploitation of this vulnerability allows an attacker to bypass authorization controls and gain unauthorized access to machine learning model outputs and management operations in Kibana spaces they should not access. This leads to disclosure of sensitive inference data and potential disruption or manipulation of active model deployments, impacting confidentiality and availability of machine learning services.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.20 or later, 9.4.5 or later, and 9.5.1 or later to remediate the issue. No additional mitigation steps are indicated beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-kibana-2026-72629
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-72629"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a85b4aaacd9273b49250f32
Added to database: 08/19/2026, 13:50:34 UTC
Last enriched: 08/19/2026, 14:07:07 UTC
Last updated: 08/20/2026, 01:52:00 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.