CVE-2026-72629 in Kibana
Summary
by MITRE • 08/13/2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of inference output from a trained model in a different space that the user is not authorized to list, read, or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and deployment update operations, allowing an active trained model deployment in another space to be stopped or to have its allocated resources altered.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described represents a critical authorization bypass flaw classified as CWE-639, which specifically targets user-controlled key mechanisms within Kibana's access control framework. This weakness allows authenticated users to manipulate system parameters that should normally be restricted, creating pathways for unauthorized cross-space access patterns. The underlying technical implementation appears to suffer from inadequate input validation and insufficient access control enforcement when processing user-supplied keys that determine resource access boundaries. The vulnerability manifests through CAPEC-1 patterns where functionality access is not properly constrained by Access Control Lists, enabling attackers to traverse logical security boundaries between different spaces within the Kibana environment.
The operational impact of this vulnerability extends beyond simple data disclosure to encompass model behavior exposure and deployment manipulation capabilities. When users can access inference outputs from trained models in unauthorized spaces, they gain insights into model behaviors, training patterns, and potentially sensitive business logic that could be exploited for competitive advantage or further attack development. The exposure of model behavior represents a significant risk because it allows adversaries to understand how systems process information, identify potential weaknesses, and develop more sophisticated attacks against the underlying machine learning infrastructure. Additionally, the ability to stop or modify deployment operations in other spaces creates opportunities for service disruption, resource exhaustion attacks, and potential compromise of production environments through manipulation of active model deployments.
Security controls for this vulnerability should address multiple layers of the system architecture while adhering to established security principles including least privilege and defense in depth strategies. Organizations should implement robust input validation mechanisms that prevent user-controlled parameters from bypassing access control checks, particularly when these parameters relate to space identifiers or model deployment configurations. The solution must ensure that all operations involving cross-space access require explicit authorization verification and that ACL enforcement occurs at multiple points within the system architecture. Mitigation approaches should include implementing strict space boundary enforcement, validating all user inputs against authorized scope boundaries, and ensuring proper audit logging of cross-space access attempts to facilitate incident response and security monitoring activities.
This vulnerability aligns with several ATT&CK framework techniques including privilege escalation through unauthorized access to resources, credential access via exploitation of insecure direct object references, and defense evasion through manipulation of system operations. The attack pattern demonstrates how seemingly innocuous user-controllable parameters can become attack vectors when proper access control boundaries are not enforced, making this a particularly dangerous class of vulnerability for enterprise environments where multiple users share common infrastructure. Organizations should consider implementing comprehensive access control reviews, regular security testing of authorization mechanisms, and enhanced monitoring for anomalous cross-space access patterns to detect potential exploitation attempts. The remediation approach must address both the immediate authorization bypass issue and establish long-term controls to prevent similar vulnerabilities from emerging in related system components through proper security design principles and continuous vulnerability assessment processes.