CVE-2026-72629: Kibana Auth Bypass via User-Controlled Key Leading to Cross-Space ML Model Access

Vulnerability Overview Vulnerability Name: Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models CVE ID: CVE-2026-72629 CVSS Score: 7.1 (High) Description: This vulnerability allows for authorization bypass via user-controlled keys, enabling cross-space access to trained machine learning models. Specifically, it permits unauthorized access to inference outputs across different spaces, thereby exposing model behavior. Additionally, the vulnerability impacts deployment stop and deployment update operations, allowing attackers to stop a trained model deployment in another space or modify its allocated resources. Affected Scope Affected Versions: - All versions from 8.19.0 to 8.19.19 - All versions from 9.0.0 to 9.4.4 - Version 9.5.0 Affected Configurations: All configurations are affected. Remediation Solution: This vulnerability has been patched in versions 8.19.20, 9.4.5, and 9.5.1. Workarounds for Users Unable to Upgrade: Currently, there are no known workarounds for this vulnerability. Additional Information Indicators of Compromise (IOCs): No specific Indicators of Compromise (IOCs) have been identified. Elastic Cloud Serverless: Due to continuous deployments and model patching, this vulnerability has been addressed in advance within the Elastic Cloud Serverless product. Related Topics Other related security updates include: - Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-105) - Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-92) - Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88) - Kibana 8.16.3 and 8.17.2 Security Update (ESA-2026-51) - Kibana 9.4.5 Security Update (ESA-2026-97) The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-72629: Kibana Auth Bypass via User-Controlled Key Leading to Cross-Space ML Model Access