CVE-2026-72629

Executive Summary

CVE-2026-72629 is an authorization bypass vulnerability in Kibana, Elastic's data visualization and management interface, arising from a CWE-639 (Authorization Bypass Through User-Controlled Key) flaw. An authenticated attacker with low-privilege access can manipulate user-controlled keys to access resources — specifically trained machine learning model inference outputs — in spaces they are not authorized to read, list, or use. The same flaw extends to model deployment operations, allowing an attacker to stop a deployment or alter its allocated resources in another space. The vulnerability carries a CVSS score of 7.1 (High), reflecting the confidentiality impact of model behavior disclosure and an availability impact of disrupting ML deployments. The product affected is Kibana, though the specific vendor is not explicitly identified in the available data; affected versions are unspecified.

Technical Analysis

This vulnerability is rooted in CWE-639: Authorization Bypass Through User-Controlled Key. In this class of flaw, the application relies on user-supplied identifiers (keys) to reference resources without adequately verifying that the authenticated principal has authorization to access the object tied to that key. The NVD description indicates that Elastic Kibana exposes functionality that allows an authenticated user to reference resources — specifically trained model data and deployment operations — across Kibana spaces using controlled keys. The authorization layer fails to constrain the access to the space in which the user operates, thereby permitting cross-space resource access.

The attack surface is entirely network-accessible via Kibana's HTTP API. The affected operations include:

• Reading inference output from a trained model in a different space
• Listing/reading model behavior (confidentiality impact)
• Triggering deployment stop operations on a model active in another space
• Modifying allocated resources of a model deployment in another space

Notably, the mechanism aligns with CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs, indicating the application's access control lists do not scope model-related operations to the space the user belongs to. The flaw likely manifests through APIs that accept references to models or deployments using global identifiers, where space-level isolation is either not enforced or can be bypassed by supplying identifiers from other spaces.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) confirms the threat model: network-exposed, low complexity, requiring low privileges (authenticated user), no user interaction, and the scope is unchanged. The primary impact is high confidentiality (model inference data disclosure), with a lower availability impact (disruption of deployments). No integrity impact is reported.

Specific code-level details, including function names, endpoints, and parameter names, are not available in the provided description. Insufficient technical detail is available to identify the exact API endpoints or request parameters involved.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (CWE-639) and the CAPEC-1 pattern described, as no public PoC is available.

1) Reconnaissance / Target Identification: An authenticated attacker enumerates Kibana spaces and identifies the space IDs of other tenants/teams within the deployment. The attacker may attempt to access the Kibana API to list spaces, models, and deployments, observing the naming conventions and identifier formats used for cross-space resource references.

2) Triggering the Flaw: The attacker crafts API requests that reference trained models or deployments using identifiers from an unauthorized space. Since the application fails to properly constrain access via ACLs, the request is processed and returns or acts upon the target resource, bypassing the intended space-level isolation.

3) Payload / Execution (vulnerability-class level): The attacker supplies a user-controlled key (model ID, deployment ID, or space identifier) in API calls for model inference, deployment update, or deployment stop operations. Because the authorization check does not verify that the key belongs to a space the user can access, the request succeeds. No specific endpoint or payload format is available; the attack is exercised through the application's existing APIs with manipulated identifiers.

4) Post-Exploitation Impact: By reading inference output, the attacker discloses the behavior of a trained model, which could reveal sensitive proprietary information, training data characteristics, or business logic. Additionally, the attacker can disrupt availability by stopping active model deployments or modifying their resource allocation (e.g., CPU/memory settings), potentially causing denial of service for dependent applications or degrading ML service performance.

The attack requires only low-privilege authenticated access, meaning any user within the Kibana deployment can potentially target resources in other spaces.

Impact Assessment

Business Impact: The confidentiality breach exposes the behavior of machine learning models, potentially revealing proprietary algorithms, sensitive training data, or intellectual property. If the models are used in regulated industries, this may trigger compliance violations. The availability impact allows an attacker to degrade or halt ML-powered features, directly affecting downstream services that rely on model inference (e.g., recommendation engines, anomaly detection, security analytics).

Affected Systems: Any Kibana deployment that hosts multiple spaces and has trained ML models onboarded. Multi-tenant environments are at highest risk, as cross-space access bypasses tenant isolation boundaries.

Blast Radius (CVSS subscores):

• Confidentiality (C:H): Complete disclosure of model inference output to unauthorized users.
• Integrity (I:N): No direct data corruption, but resource modification may have indirect integrity implications.
• Availability (A:L): Deployment stop/update operations can disrupt model serving, causing degraded performance or temporary unavailability.

The overall CVSS score of 7.1 (High) reflects a serious vulnerability that is easy to exploit remotely with low privileges.

Detection Guidance

Sigma Rule

title: Kibana Cross-Space Model Access Attempt
id: 7a2d9f3b-5c4e-4f8a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects attempts to access Kibana ML model inference or deployment operations referencing resources outside the user's assigned space.
tags:
    - attack.initial_access
    - attack.t1213
logsource:
    product: elastic
    service: kibana
detection:
    selection:
        event.module: kibana
        event.action:
            - model_inference
            - update_deployment
            - stop_deployment
    filter_known:
        kibana.space_id: "*"
    condition: selection and not filter_known
level: high
falsepositives:
    - Legitimate cross-space operations by administrators or service accounts
fields:
    - user.name
    - source.ip
    - kibana.space_id
    - url.path

YARA Rule

rule Kibana_CrossSpace_Model_Access
{
    meta:
        author = "Valter's IT SOC"
        description = "Detects Kibana HTTP requests attempting unauthorized cross-space model access"
        cve = "CVE-2026-72629"
        date = "2026-01-01"
    strings:
        $s1 = "model" ascii nocase
        $s2 = "deployment" ascii nocase
        $s3 = "inference" ascii nocase
        $s4 = "space" ascii nocase
        $s5 = "update" ascii nocase
        $s6 = "stop" ascii nocase
    condition:
        3 of ($s*) and filesize < 50KB
}

Suricata IDS Rule

alert http any any -> $KIBANA_SERVERS 5601 (msg:"Kibana Potential Cross-Space Model Access (CVE-2026-72629)"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"model"; http_uri; content:"inference"; http_uri; content:"deployment"; http_uri; pcre:"/(model|deployment|inference|update|stop)/i"; classtype:attempted-recon; reference:cve,2026-72629; sid:2710001; rev:1;)

Elastic Detection

{
  "query": {
    "bool": {
      "must": [
        { "match": { "event.module": "kibana" } },
        { "match": { "event.action": "model_inference" } }
      ],
      "should": [
        { "wildcard": { "url.path": "*model*" } },
        { "wildcard": { "url.path": "*deployment*" } }
      ],
      "minimum_should_match": 1
    }
  }
}

Splunk SPL Query

index=* sourcetype=*kibana* OR source="/var/log/kibana/*"
| where lower(action) IN ("model_inference", "update_deployment", "stop_deployment")
| search url.path=*model*
| stats count by user, source_ip, kibana_space, url.path
| where count > 5

Wazuh OSSEC Rule

<group name="kibana,">
    <rule id="271001" level="12">
        <decoded_as>json</decoded_as>
        <field name="event.module">kibana</field>
        <field name="event.action">model_inference</field>
        <description>Kibana cross-space model inference attempt detected (CVE-2026-72629)</description>
        <mitre>
            <id>T1213</id>
        </mitre>
        <group>access_control</group>
    </rule>
    <rule id="271002" level="12">
        <decoded_as>json</decoded_as>
        <field name="event.module">kibana</field>
        <field name="event.action">stop_deployment</field>
        <description>Kibana unauthorized deployment stop attempt (CVE-2026-72629)</description>
        <group>access_control</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-72629 is UNPATCHED. Patch confidence is 0/4 — no patch evidence exists from any tracked source, and no vendor fix has been published. Affected versions are unspecified, and no workarounds have been officially provided by the vendor.

Immediate Mitigations:

1. Restrict API access: Limit access to Kibana's machine learning and deployment APIs to only trusted administrators using network-level controls (firewall rules, ingress policies).
2. Enforce least privilege: Review all user roles and spaces; ensure only users explicitly requiring cross-space model access have the relevant privileges.
3. Enable auditing: Turn on audit logging for Kibana API operations, especially model inference and deployment management actions, to enable detection of suspicious cross-space activity.
4. Network segmentation: Segment Kibana instances by tenant or space where possible to reduce the blast radius of a compromised low-privilege account.

Patch/Upgrade Steps:

• Monitor the vendor's security advisory channels for a patch release. The vendor is unknown in the current data, but the product is Kibana — consult the appropriate vendor's official security bulletins for the Kibana version in use.
• When a patch is released, upgrade all affected Kibana instances immediately, prioritizing internet-exposed deployments.

Long-Term Hardening:

• Implement strict input validation and server-side authorization checks (verify user space membership against the resource's space before processing any request).
• Adopt a zero-trust architecture where space isolation is enforced at the API layer, not just the UI layer.
• Regularly audit user roles and permissions to ensure no over-privileged accounts exist.
• Deploy a web application firewall (WAF) with rules to detect unusual cross-space resource access patterns.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72629
2. MITRE CWE-639: https://cwe.mitre.org/data/definitions/639.html
3. MITRE CAPEC-1: https://capec.mitre.org/data/definitions/1.html
4. Elastic Security Advisories (monitor for patch): https://www.elastic.co/community/security
5. CISA KEV: Not listed (no known exploited vulnerability status)

Threat Actor Campaign Notes: No evidence of active exploitation or known threat actor campaigns was identified at the time of writing. The PoC status is UNKNOWN, and no exploit code or Nuclei templates are available publicly.