Elastic Kibana

Kibana AI Inference Engine DoS via Regex Blowup
CVE-2026-26936 4.9 - Medium - February 26, 2026

Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

ReDoS

Kibana DS via Improper Input Validation in Content Connectors Search Endpoint
CVE-2026-26935 6.5 - Medium - February 26, 2026

Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

Improper Input Validation

Kibana DoS via Improper Quantity Validation
CVE-2026-26934 6.5 - Medium - February 26, 2026

Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.

Improper Validation of Specified Quantity in Input

Elastic Security: External Path & SSRF File Disclosure
CVE-2026-0532 8.6 - High - January 14, 2026

External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.

SSRF

Kibana Email Connector CVE-2026-0543: Improper Input Validation (CWE-20)
CVE-2026-0543 6.5 - Medium - January 13, 2026

Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.

Improper Input Validation

Elastic Kibana Fleet: Memory Exhaustion via Bulk Retrieval (CWE-770)
CVE-2026-0531 6.5 - Medium - January 13, 2026

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.

Allocation of Resources Without Limits or Throttling

Kibana Fleet Resource Exhaustion via Crafted Request (CVE-2026-0530)
CVE-2026-0530 6.5 - Medium - January 13, 2026

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.

Allocation of Resources Without Limits or Throttling

Kibana Privilege Escalation via AuthBypass HTTP Request (CVE-2025-68422)
CVE-2025-68422 4.3 - Medium - December 18, 2025

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.

AuthZ

Kibana: Improper Auth Enables Global Document Sharing (CWE-285)
CVE-2025-68386 4.3 - Medium - December 18, 2025

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.

AuthZ

Kibana Resource Leak: Authenticated DoS via Crafted HTTP (CVE-2025-68389)
CVE-2025-68389 6.5 - Medium - December 18, 2025

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.

Allocation of Resources Without Limits or Throttling

Vega XSS via Vulnerable AST Evaluator
CVE-2025-68387 6.1 - Medium - December 18, 2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.

XSS

Vega XSS via Input Neutralization Bypass (CVE-2025-68385)
CVE-2025-68385 7.2 - High - December 18, 2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.

XSS

SAP Enterprise Portal Auth XSS via Integration Package Upload
CVE-2025-37732 5.4 - Medium - December 15, 2025

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a users browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

XSS

SSRF via Forged Origin Header in Kibana Observability AI Assistant
CVE-2025-37734 4.3 - Medium - November 12, 2025

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

Origin Validation Error

Elastic Defend WOS Improper Perm Preservation Enables File Deletion & LPE
CVE-2025-37735 7 - High - November 06, 2025

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.

Improper Preservation of Permissions

Kibana XSS via Improper Input Neutralization in Web Page Generation
CVE-2025-25017 8.2 - High - October 10, 2025

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

XSS

Kibana Stored XSS due to Improper Input Neutralization
CVE-2025-25018 8.7 - High - October 10, 2025

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

XSS

Kibana Stored XSS via Unescaped Inputs in Case File Upload
CVE-2025-25009 8.7 - High - October 07, 2025

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

XSS

Insuff. Protected Credentials in CrowdStrike Connector
CVE-2025-37728 5.4 - Medium - October 07, 2025

Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.

Insufficiently Protected Credentials

Kibana Open Redirect (CVE-2025-25012)
CVE-2025-25012 - June 25, 2025

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

Kibana Improper Auth: Privilege Abuse via Synthetic Monitor
CVE-2024-43706 - June 10, 2025

Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.

Prototype Pollution in Kibana Enables Arbitrary Code Execution
CVE-2025-25014 9.1 - Critical - May 06, 2025

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Prototype Pollution

Kibana Synthetics Unrestricted Upload Allows XSS via crafted files
CVE-2024-11390 - May 01, 2025

Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victims browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.

Kibana Unrestricted File Upload CVE-2025-25016
CVE-2025-25016 - May 01, 2025

Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

Kibana Prototype Pollution Permits Code Exec via Unrestricted Upload & Path Trv
CVE-2024-12556 8.7 - High - April 08, 2025

Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

Prototype Pollution

Kibana Observability API Crash via Malicious Request (Read Access Required)
CVE-2024-52974 - April 08, 2025

An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.

Kibana 8.15-8.17 Prototype Pollution -> Arbitrary Code Exec via Crafted Upload
CVE-2025-25015 - March 05, 2025

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors

Kibana Resource Exhaustion via UI Payload (CVE-2024-43708)
CVE-2024-43708 - January 23, 2025

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.

Kibana: Unbounded Resource Allocation Crash via /api/metrics/snapshot
CVE-2024-52972 - January 23, 2025

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.

Kibana: Fleet Policy Leakage to Unauthorized Users
CVE-2024-43707 - January 23, 2025

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.

CVE-2024-43710: SSRF via Kibana Fleet /api/health_check API
CVE-2024-43710 - January 23, 2025

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

Kibana Crash: Unlimited Resource Allocation via /api/log_entries/summary
CVE-2024-52973 - January 21, 2025

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.

Kibana YAML Deserialization RCE Requires Index & Fleet Privileges
CVE-2024-37285 - November 14, 2024

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Servers service account token

Kibana Arbitrary Code Exec via YAML Deserialization in Elastic AI
CVE-2024-37288 8.8 - High - September 09, 2024

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Securitys built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html  and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .

Marshaling, Unmarshaling

Kibana Prototype Pollution Arbitrary Code Execution via ML Features
CVE-2024-37287 7.2 - High - August 13, 2024

A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.

Prototype Pollution

Kibana Crash via Malicious Viewer API Requests
CVE-2024-37281 - July 30, 2024

An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.

Kibana osquery Pack Upload Denial of Service Vulnerability
CVE-2024-23443 4.9 - Medium - June 19, 2024

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

CVE-2024-23442: Open Redirect in Kibana Enables Arbitrary Site Redirection
CVE-2024-23442 6.1 - Medium - June 14, 2024

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

Open Redirect

Kibana Alerting run_soon API Abuse by View-Only Users
CVE-2024-37279 4.3 - Medium - June 13, 2024

A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

Elastic Detection Engine Search API Bypasses DLS/FLS on .alerts-security.indices
CVE-2024-23446 6.5 - Medium - February 07, 2024

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

Kibana 8.11.1: Log Info Leak CVE202346675
CVE-2023-46675 6.5 - Medium - December 13, 2023

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.

Insertion of Sensitive Information into Log File

Kibana logs expose credentials before 8.11.1
CVE-2023-46671 6.5 - Medium - December 13, 2023

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions).

Insertion of Sensitive Information into Log File

Kibana Path Traversal: Arbitrary .pbf File Access
CVE-2021-22151 4.3 - Medium - November 22, 2023

It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

Directory traversal

Kibana js-yaml Injection via Admin Package Upload (CVE-2021-22150)
CVE-2021-22150 7.2 - High - November 22, 2023

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

Code Injection

Kibana Chromium Rendering Exploit via Reporting Feature
CVE-2021-22142 8.8 - High - November 22, 2023

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protections to prevent this browser from rendering arbitrary content.

Kibana 8.10.0 Sensitive Info Leak in Logs (JSON/Layout Error)
CVE-2023-31422 7.5 - High - October 26, 2023

An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in the log contains request information, which can include sensitive data, such as authentication credentials, cookies, authorization headers, query params, request paths, and other metadata. Some examples of sensitive data which can be included in the logs are account credentials for kibana_system, kibana-metricbeat, or Kibana end-users.

Insertion of Sensitive Information into Log File

Arbitrary Code Execution in Kibana 8.0.0-8.7.0 via Config Write Access
CVE-2023-31414 8.8 - High - May 04, 2023

Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Code Injection

Kibana 8.7.0 RCE via Uptime/Synthetics (exec flaw CVE-2023-31415)
CVE-2023-31415 8.8 - High - May 04, 2023

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of the Kibana process.

Code Injection

Unauthenticated Exploit via Log Viewing Grants Privilege Escalation in Kibana
CVE-2023-22300 6.1 - Medium - March 27, 2023

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation.

XSS

Kibana Open Redirect via Malicious URL (CVE-2022-38779)
CVE-2022-38779 6.1 - Medium - February 22, 2023

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

Open Redirect