Elastic Kibana

Kibana SSRF Allowlist Bypass via Connector Permissions
CVE-2026-49093 6.3 - Medium - May 28, 2026

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

SSRF

Kibana CVE-2026-49094: Auth Viewer DoS via Oversized Input
CVE-2026-49094 6.5 - Medium - May 28, 2026

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.

Resource Exhaustion

Kibana Fleet Policy Injection Privilege Escalation
CVE-2026-49095 7.2 - High - May 28, 2026

Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role.

Improper Input Validation

Kibana SSRF Auth Users Bypass Egress Allowlist via Webhook Connector
CVE-2026-42398 7.7 - High - May 28, 2026

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

SSRF

Kibana Uncontrolled Resource Consumption via Crafty Timelion Expr (CAPEC-130)
CVE-2026-42399 6.5 - Medium - May 28, 2026

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.

Resource Exhaustion

Kibana Resource Exhaustion via Authenticated Compressed Payload
CVE-2026-42400 6.5 - Medium - May 28, 2026

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.

Resource Exhaustion

Kibana Stored XSS via Unsanitized Index Data (CWE79)
CVE-2026-42401 4.1 - Medium - May 28, 2026

Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently sanitized. Successful exploitation could result in unauthorized UI manipulation and outbound network requests issued from the viewing user's browser session.

XSS

Kibana Token Bypass: Post-Expiration Access (CVE-2026-33463)
CVE-2026-33463 5.3 - Medium - May 28, 2026

Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.

Operation on a Resource after Expiration or Release

Kibana Uncontrolled Resource Consumption via Oversized Payload (CVE-2026-33464)
CVE-2026-33464 6.5 - Medium - May 28, 2026

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.

Resource Exhaustion

Kibana Dashboard PKG Path Traversal Allows Admin Deletion of Arbitrary Accounts
CVE-2026-33462 4.6 - Medium - May 28, 2026

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.

Directory traversal

SSRF in Kibana One Workflow allows internal endpoint disclosure
CVE-2026-33458 6.8 - Medium - April 08, 2026

Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

SSRF

Kibana Authenticated DoS via Excessive Allocation in Automatic Import
CVE-2026-33459 6.5 - Medium - April 08, 2026

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.

Resource Exhaustion

Kibana Auth Bypass via Unscoped Client Leaks Cross-Space Data
CVE-2026-33460 4.3 - Medium - April 08, 2026

Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.

AuthZ

Kibana Internal API Auth Bypass Exposing Sensitive Config Data
CVE-2026-33461 7.7 - High - April 08, 2026

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.

AuthZ

CVE-2026-4498: Kibana Fleet Plugin Debug Route Privilege Abuse (CWE-250)
CVE-2026-4498 7.7 - High - April 08, 2026

Execution with Unnecessary Privileges (CWE-250) in Kibanas Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).

Execution with Unnecessary Privileges

Kibana Timelion Plugin DOS via Overly Large Quantity Value
CVE-2026-26940 6.5 - Medium - March 19, 2026

Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.

Improper Validation of Specified Quantity in Input

Auth Bypass in Kibana Rule Management (CVE-2026-26939)
CVE-2026-26939 6.5 - Medium - March 19, 2026

Missing Authorization (CWE-862) in Kibanas server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.

AuthZ

Elastic Kibana Workflows RCE via ServerSide Template Injection
CVE-2026-26938 8.6 - High - February 26, 2026

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.

1336

Kibana Timelion Uncontrolled Res. Consumption (CWE-400)
CVE-2026-26937 6.5 - Medium - February 26, 2026

Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

Resource Exhaustion

Kibana AI Inference Engine DoS via Regex Blowup
CVE-2026-26936 4.9 - Medium - February 26, 2026

Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

ReDoS

Kibana DS via Improper Input Validation in Content Connectors Search Endpoint
CVE-2026-26935 6.5 - Medium - February 26, 2026

Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

Improper Input Validation

Kibana DoS via Improper Quantity Validation
CVE-2026-26934 6.5 - Medium - February 26, 2026

Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.

Improper Validation of Specified Quantity in Input

Elastic Security: External Path & SSRF File Disclosure
CVE-2026-0532 8.6 - High - January 14, 2026

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

SSRF

Kibana Email Connector CVE-2026-0543: Improper Input Validation (CWE-20)
CVE-2026-0543 6.5 - Medium - January 13, 2026

Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.

Improper Input Validation

Elastic Kibana Fleet: Memory Exhaustion via Bulk Retrieval (CWE-770)
CVE-2026-0531 6.5 - Medium - January 13, 2026

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.

Allocation of Resources Without Limits or Throttling

Kibana Fleet Resource Exhaustion via Crafted Request (CVE-2026-0530)
CVE-2026-0530 6.5 - Medium - January 13, 2026

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.

Allocation of Resources Without Limits or Throttling

Kibana Privilege Escalation via AuthBypass HTTP Request (CVE-2025-68422)
CVE-2025-68422 4.3 - Medium - December 18, 2025

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.

AuthZ

Kibana: Improper Auth Enables Global Document Sharing (CWE-285)
CVE-2025-68386 4.3 - Medium - December 18, 2025

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.

AuthZ

Kibana Resource Leak: Authenticated DoS via Crafted HTTP (CVE-2025-68389)
CVE-2025-68389 6.5 - Medium - December 18, 2025

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.

Allocation of Resources Without Limits or Throttling

Vega XSS via Vulnerable AST Evaluator
CVE-2025-68387 6.1 - Medium - December 18, 2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.

XSS

Vega XSS via Input Neutralization Bypass (CVE-2025-68385)
CVE-2025-68385 7.2 - High - December 18, 2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.

XSS

SAP Enterprise Portal Auth XSS via Integration Package Upload
CVE-2025-37732 5.4 - Medium - December 15, 2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a users browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

XSS

SSRF via Forged Origin Header in Kibana Observability AI Assistant
CVE-2025-37734 4.3 - Medium - November 12, 2025

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

Origin Validation Error

Elastic Defend WOS Improper Perm Preservation Enables File Deletion & LPE
CVE-2025-37735 7 - High - November 06, 2025

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.

Improper Preservation of Permissions

Kibana XSS via Improper Input Neutralization in Web Page Generation
CVE-2025-25017 8.2 - High - October 10, 2025

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

XSS

Kibana Stored XSS due to Improper Input Neutralization
CVE-2025-25018 8.7 - High - October 10, 2025

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

XSS

Kibana Stored XSS via Unescaped Inputs in Case File Upload
CVE-2025-25009 8.7 - High - October 07, 2025

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

XSS

Insuff. Protected Credentials in CrowdStrike Connector
CVE-2025-37728 5.4 - Medium - October 07, 2025

Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.

Insufficiently Protected Credentials

Kibana Open Redirect (CVE-2025-25012)
CVE-2025-25012 - June 25, 2025

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

Kibana Improper Auth: Privilege Abuse via Synthetic Monitor
CVE-2024-43706 - June 10, 2025

Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.

Prototype Pollution in Kibana Enables Arbitrary Code Execution
CVE-2025-25014 9.1 - Critical - May 06, 2025

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Prototype Pollution

Kibana Synthetics Unrestricted Upload Allows XSS via crafted files
CVE-2024-11390 - May 01, 2025

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victims browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

Kibana Unrestricted File Upload CVE-2025-25016
CVE-2025-25016 - May 01, 2025

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

Kibana Prototype Pollution Permits Code Exec via Unrestricted Upload & Path Trv
CVE-2024-12556 8.7 - High - April 08, 2025

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

Prototype Pollution

Kibana Observability API Crash via Malicious Request (Read Access Required)
CVE-2024-52974 - April 08, 2025

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.

Kibana 8.15-8.17 Prototype Pollution -> Arbitrary Code Exec via Crafted Upload
CVE-2025-25015 - March 05, 2025

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors

Kibana Resource Exhaustion via UI Payload (CVE-2024-43708)
CVE-2024-43708 - January 23, 2025

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.

Kibana: Unbounded Resource Allocation Crash via /api/metrics/snapshot
CVE-2024-52972 - January 23, 2025

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

CVE-2024-43710: SSRF via Kibana Fleet /api/health_check API
CVE-2024-43710 - January 23, 2025

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

Kibana: Fleet Policy Leakage to Unauthorized Users
CVE-2024-43707 - January 23, 2025

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.