CVE-2026-72629

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An authorization bypass occurs due to a user-controlled key, allowing unauthorized cross-space access because functionality is not properly constrained by Access Control Lists (ACLs). This issue enables users to access inference output from trained models in spaces they are not authorized to list, read, or use, thereby exposing model behavior. Additionally, this flaw affects deployment stop and deployment update operations, which could allow an attacker to stop an active trained model deployment in another space or alter its allocated resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.