Elastic Kibana
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Elastic Kibana.
Known Exploited Elastic Kibana Vulnerabilities
The following Elastic Kibana vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Kibana Arbitrary Code Execution |
Kibana contain an arbitrary code execution flaw in the Timelion visualizer. CVE-2019-7609 Exploit Probability: 95.3% |
January 10, 2022 |
The vulnerability CVE-2019-7609: Kibana Arbitrary Code Execution is in the top 1% of the currently known exploitable vulnerabilities.
By the Year
In 2026 there have been 73 vulnerabilities in Elastic Kibana with an average score of 6.3 out of ten. Last year, in 2025 Kibana had 25 security vulnerabilities published. That is, 48 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.40
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 73 | 6.30 |
| 2025 | 25 | 6.71 |
| 2024 | 8 | 6.30 |
| 2023 | 11 | 7.01 |
| 2022 | 7 | 5.53 |
| 2021 | 5 | 4.25 |
| 2020 | 6 | 6.10 |
| 2019 | 5 | 8.30 |
| 2018 | 7 | 7.16 |
It may take a day or so for new Kibana vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Elastic Kibana Security Vulnerabilities
Kibana Cases Uncaught Exception - Denial of Service via Malformed Link
CVE-2026-49096
4.3 - Medium
- August 13, 2026
Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.
Uncaught Exception
Kibana Fleet API Key Disclosure via Faulty Observable Filtering
CVE-2026-72632
7.1 - High
- August 13, 2026
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.
Side Channel Attack
Kibana Fleet privilege escalation via API key injection
CVE-2026-72631
6.5 - Medium
- August 13, 2026
Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents
Improper Privilege Management
Kibana Fleet Auth Mischeck Enables Privilege Escalation
CVE-2026-72630
7.1 - High
- August 13, 2026
Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.
AuthZ
Kibana Auth Bypass (CWE-639) Exposes Model Inference Output
CVE-2026-72629
7.1 - High
- August 13, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of inference output from a trained model in a different space that the user is not authorized to list, read, or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and deployment update operations, allowing an active trained model deployment in another space to be stopped or to have its allocated resources altered.
Insecure Direct Object Reference / IDOR
Kibana Agent Builder Owner Mismatch Enables Unauthorized Agent Changes
CVE-2026-72643
7.1 - High
- August 13, 2026
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed.
AuthZ
Unauthorized case data edit in Elastic Security Kibana (CVE-2026-72655)
CVE-2026-72655
4.3 - Medium
- August 13, 2026
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view.
Mass Assignment
Kibana Resource Exhaustion DoS via Malformed Maintenance Window Payload
CVE-2026-72653
6.5 - Medium
- August 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.
Allocation of Resources Without Limits or Throttling
Kibana Authenticated Read-Only User Causes DOS via Resource Exhaustion
CVE-2026-72651
6.5 - Medium
- August 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.
Allocation of Resources Without Limits or Throttling
Kibana Auth Bypass via User-Key Exposes Cross-Space Telemetry
CVE-2026-72650
4.3 - Medium
- August 13, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.
Insecure Direct Object Reference / IDOR
Kibana TSVB DoS via Input Data Manipulation (CWE-407)
CVE-2026-72663
6.5 - Medium
- August 13, 2026
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.
Inefficient Algorithmic Complexity
Kibana CVE-2026-72661: Missing Auth Enables Data Disclosure via Unconstrained ACLs
CVE-2026-72661
6.5 - Medium
- August 13, 2026
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts.
AuthZ
Kibana Uncaught Exception DoS via Improper Input Validation
CVE-2026-72660
6.5 - Medium
- August 13, 2026
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.
Uncaught Exception
Kibana: Unbounded Memory Allocation via Malformed Visualization Payload (CWE-770)
CVE-2026-72659
6.5 - Medium
- August 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.
Allocation of Resources Without Limits or Throttling
Privilege Escalation via XSRF in Kibana Vega Visualizations
CVE-2026-72658
7.3 - High
- August 13, 2026
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.
Session Riding
DoS via Unbounded Resource Allocation in Kibana Validation
CVE-2026-72667
6.5 - Medium
- August 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat.
Allocation of Resources Without Limits or Throttling
Kibana Auth Bypass via User-Key (CWE-639) enabling CrossSpace Host Query
CVE-2026-72666
6.8 - Medium
- August 13, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.
Insecure Direct Object Reference / IDOR
Missing Authorization in Kibana Enables Unauthorized Osquery Exec
CVE-2026-72665
8.1 - High
- August 13, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.
AuthZ
Kibana CALE Unauthorized Exec of Elastic Defend Actions
CVE-2026-72664
6.5 - Medium
- August 13, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution can associate automated endpoint response actions with a detection rule, even though the dedicated Endpoint response action privileges that govern those capabilities (host isolation, process operations, and execute operations) have not been granted to that user. When such a rule generates alerts, the associated response actions are carried out against the matching hosts.
AuthZ
Kibana PT Enables Unauth Deletion via Config ID
CVE-2026-72677
7.3 - High
- August 13, 2026
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
Relative Path Traversal
Missing Auth in Kibana ML Cross-Space Data Leak & Mod
CVE-2026-72675
7.1 - High
- August 13, 2026
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.
AuthZ
DoS via Unbounded Field List in Kibana (CVE-2026-72674)
CVE-2026-72674
6.5 - Medium
- August 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.
Allocation of Resources Without Limits or Throttling
Kibana Synthetics Auth Bypass Unlocks Private Loc. Deletion
CVE-2026-72673
5.4 - Medium
- August 13, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is shared with. The safeguard that prevented the deletion of a private location still in use evaluated only the monitors visible in the requesting user's own space, so monitors that depend on the private location in other spaces were not taken into account. As a result, an authenticated Kibana user holding the Synthetics write privilege in a single space could delete a private location that other spaces still depend on, even where the user has no access to those spaces. Deleting the private location removes the shared configuration and stops the monitors in the other spaces from running, which suppresses the availability monitoring those spaces rely on.
AuthZ
Kibana Sec Query Bypass: Field Value Retrieval Leak
CVE-2026-72672
7.7 - High
- August 13, 2026
The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.
AuthZ
Kibana ML Delete Saved Object Missing Trained Model Privilege
CVE-2026-72671
4.3 - Medium
- August 13, 2026
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user.
AuthZ
Elastic Fleet Proxy Config Disclosure via Read Agent Policy Privilege
CVE-2026-72670
7.7 - High
- August 13, 2026
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.
Information Disclosure
Kibana Observability Onboarding State Priv Escal via Unbound User State
CVE-2026-72669
7.6 - High
- August 13, 2026
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error.
AuthZ
Kibana Agent Builder privilege escalation via missing feature check
CVE-2026-72681
6.5 - Medium
- August 13, 2026
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.
AuthZ
Auth user may overwrite other A2A conversation in Kibana Agent Builder
CVE-2026-72680
6.5 - Medium
- August 13, 2026
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.
Insecure Direct Object Reference / IDOR
Unbounded Allocation in Kibana Leads to DoS via Overly Large Connector Query
CVE-2026-49089
6.5 - Medium
- August 13, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.
Allocation of Resources Without Limits or Throttling
CVE-2026-63262: Auth Bypass in Kibana Enables Cross-space Disclosure
CVE-2026-63262
4.3 - Medium
- July 21, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.
AuthZ
Kibana ML Feature Uncontrolled Resource Consumption (CWE-400) DoS
CVE-2026-63261
6.5 - Medium
- July 21, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.
Resource Exhaustion
Kibana Uncontrolled Resource Consumption via Oversized Payload DoS
CVE-2026-63260
6.5 - Medium
- July 21, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.
Resource Exhaustion
Kibana Auth Bypass via User-Key Exposes Scheduled Query Data
CVE-2026-63259
4.3 - Medium
- July 21, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.
Insecure Direct Object Reference / IDOR
Kibana ML ACL Bypass Enables Audit & Notification Record Manipulation
CVE-2026-63145
4.3 - Medium
- July 21, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobsincluding jobs in other spaces or belonging to other usersby leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.
AuthZ
Missing Auth in Kibana Unauthorized Data Disclosure
CVE-2026-63143
4.3 - Medium
- July 21, 2026
Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.
AuthZ
Kibana Reporting: Auth Bypass via Missing Disallowed Inputs (CWE-184)
CVE-2026-63142
5 - Medium
- July 21, 2026
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
AuthZ
Kibana Auth Bypass: Authenticated Users can Modify Cloud Connect Settings
CVE-2026-63141
6.3 - Medium
- July 21, 2026
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.
AuthZ
Kibana Canvas Authenticated DoS via Uncontrolled Resource Consumption
CVE-2026-63139
6.5 - Medium
- July 21, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.
Resource Exhaustion
Kibana Auth Bypass via UserControlled Key (CWE639)
CVE-2026-56147
7.1 - High
- July 21, 2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments such as those associated with Security Solution cases without holding the privileges required to access those features.
Insecure Direct Object Reference / IDOR
Kibana Improper Access Control Enables Unauthorized Watchlist Modification
CVE-2026-56146
5.4 - Medium
- July 21, 2026
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that should require elevated privileges. Under specific deployment conditions, this could also allow such a user to access data beyond their authorized scope.
AuthZ
DoS via Oversized Input in Kibana Entity Analytics
CVE-2026-42397
6.5 - Medium
- July 21, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable.
Allocation of Resources Without Limits or Throttling
Kibana Confused Deputy Proxy Privilege Escalation
CVE-2026-49092
4.3 - Medium
- July 21, 2026
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.
AuthZ
Log Injection Vulnerability (CWE-117) in Kibana (Elastic)
CVE-2026-49091
8 - High
- July 01, 2026
Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.
Output Sanitization
Kibana APM Logs Leak Sensitive Headers via Log Injection (CWE-532)
CVE-2026-49088
4.4 - Medium
- July 01, 2026
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
Insertion of Sensitive Information into Log File
Kibana DoS via Excessive Bulk Deletion Resource Exhaustion
CVE-2026-49087
6.5 - Medium
- July 01, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.
Allocation of Resources Without Limits or Throttling
Kibana Improper Input Validation Allows Authenticated DoS
CVE-2026-56151
6.5 - Medium
- July 01, 2026
Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.
Improper Input Validation
Kibana SSRF Allowlist Bypass via Connector Permissions
CVE-2026-49093
6.3 - Medium
- May 28, 2026
Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.
SSRF
Kibana CVE-2026-49094: Auth Viewer DoS via Oversized Input
CVE-2026-49094
6.5 - Medium
- May 28, 2026
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
Resource Exhaustion
Kibana Fleet Policy Injection Privilege Escalation
CVE-2026-49095
7.2 - High
- May 28, 2026
Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role.
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Elastic Kibana or by Elastic? Click the Watch button to subscribe.
