CVE-2026-26939
published 2026-03-19CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.18%
7.1th percentile
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | — | — |
| elastic | kibana | >= 8.0.0 < 8.19.12 | 8.19.12 |
| elastic | kibana | 8.0.0 – 8.19.11 | — |
| elastic | kibana | >= 9.0.0 < 9.2.6 | 9.2.6 |
| elastic | kibana | 9.0.0 – 9.2.5 | — |
| elastic | kibana | 9.3.0 – 9.3.0 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x4hf-rw83-jxhf: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (hos
ghsa_unreviewed·2026-03-19
CVE-2026-26939 [MEDIUM] CWE-862 GHSA-x4hf-rw83-jxhf: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (hos
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
Red Hat
Kibana: Kibana: Unauthorized system control via missing authorization
vendor_redhat·2026-03-19·CVSS 6.5
CVE-2026-26939 [MEDIUM] CWE-1220 Kibana: Kibana: Unauthorized system control via missing authorization
Kibana: Kibana: Unauthorized system control via missing authorization
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
A flaw was found in Kibana. An authenticated attacker with rule management privileges could exploit a missing authorization vulnerability in the server-side Detection Rule Management. This allows the attacker to configure unauthorized endpoint response actions, such as host isolation, process termination, and process suspension. This could lead to a denial of service or im
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-26934 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26934 [MEDIUM] CVE-2026-26934 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26934 :
Kibana vulnerability analysis and mitigation
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.
Source : NVD
## 6.5
Score
Published February 26, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 19.9
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
cpe:2.3:a:elastic:kib
Wiz
CVE-2026-0531 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-0531 [MEDIUM] CVE-2026-0531 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0531 :
Kibana vulnerability analysis and mitigation
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.
Source : NVD
## 6.5
Score
Published January 13, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploit
Wiz
CVE-2026-0543 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-0543 [MEDIUM] CVE-2026-0543 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0543 :
Kibana vulnerability analysis and mitigation
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
Source : NVD
## 6.5
Score
Published January 13, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percenti
Wiz
CVE-2026-26939 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26939 [MEDIUM] CVE-2026-26939 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26939 :
Kibana vulnerability analysis and mitigation
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
Source : NVD
## 6.5
Score
Published March 19, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.9
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-9.2
kibana-9.3
Sources
M
Wiz
CVE-2025-68386 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.3
CVE-2025-68386 [MEDIUM] CVE-2025-68386 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68386 :
Kibana vulnerability analysis and mitigation
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
Source : NVD
## 4.3
Score
Published December 18, 2025
Severity MEDIUM
CNA Score 4.3
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-9.2
kibana
Sources
Chainguard Has Fix Added at: Jan 28, 2026
MinimOS Severi
Wiz
CVE-2025-68385 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.2
CVE-2025-68385 [HIGH] CVE-2025-68385 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68385 :
Kibana vulnerability analysis and mitigation
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
Source : NVD
## 6.1
Score
Published December 18, 2025
Severity MEDIUM
CNA Score 7.2
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-8.17
kibana-8.18
Sources
Chainguard Has Fix Added at: Jan 28, 2
Wiz
CVE-2026-0532 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.6
CVE-2026-0532 [HIGH] CVE-2026-0532 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0532 :
Kibana vulnerability analysis and mitigation
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Source : NVD
## 8.6
Score
Published January 14, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N
Wiz
CVE-2025-68387 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2025-68387 [MEDIUM] CVE-2025-68387 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68387 :
Kibana vulnerability analysis and mitigation
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.
Source : NVD
## 6.1
Score
Published December 18, 2025
Severity MEDIUM
CNA Score 6.1
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 29
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
kibana-9.1
kibana-9.2
Sources
Chainguard Has Fix Added at: Jan 28,
Wiz
CVE-2025-68389 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2025-68389 [MEDIUM] CVE-2025-68389 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68389 :
Kibana vulnerability analysis and mitigation
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.
Source : NVD
## 6.5
Score
Published December 18, 2025
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 49.9
Exploitation Probability (EPSS) 0.3
Affected packages and libraries
kibana-8.17
kibana-8.18
Sources
Chainguard Has Fix Added at: Jan 28, 2026
MinimOS Severity MEDIUM Has Fix Added
Wiz
CVE-2025-68422 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.3
CVE-2025-68422 [MEDIUM] CVE-2025-68422 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68422 :
Kibana vulnerability analysis and mitigation
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.
Source : NVD
## 4.3
Score
Published December 18, 2025
Severity MEDIUM
CNA Score 4.3
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-9.2
cpe:2.3:a:elastic:kibana
Sources
Chainguard Has Fix Add
Wiz
CVE-2026-0528 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-0528 [MEDIUM] CVE-2026-0528 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0528 :
Kibana vulnerability analysis and mitigation
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.
Source : NVD
## 7.5
Score
Published January 13, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/
Wiz
CVE-2026-26935 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26935 [MEDIUM] CVE-2026-26935 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26935 :
Kibana vulnerability analysis and mitigation
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Source : NVD
## 7.5
Score
Published February 26, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 24.6
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
kibana-8.19
kibana-9.2
Sources
MinimOS Severity HIGH Has Fix Added at: Mar 03, 2026
Nix Severity HIGH Has Fix Added at: Mar 03, 2026
Linux Severity HIGH Has Fix Added at: Mar 02, 2026
Windows Severity HIGH Has Fix Ad
Wiz
CVE-2026-0530 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-0530 [MEDIUM] CVE-2026-0530 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0530 :
Kibana vulnerability analysis and mitigation
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.
Source : NVD
## 6.5
Score
Published January 13, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.5
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
cpe:2.3:a:elastic:kibana
kibana-8.17
Sources
Ch
Wiz
CVE-2026-26936 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26936 [MEDIUM] CVE-2026-26936 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26936 :
Kibana vulnerability analysis and mitigation
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
Source : NVD
## 7.5
Score
Published February 26, 2026
Severity HIGH
CNA Score 4.9
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 23.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
kibana
kibana-8.19
Sources
MinimOS Severity HIGH Has Fix Added at: Mar 03, 2026
Nix Severity HIGH Has Fix Added at: Mar 03, 2026
Linux Severity HIGH Has Fix Added at: Mar 02, 2026
Windows Sever
Wiz
CVE-2026-26931 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26931 [MEDIUM] CVE-2026-26931 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26931 :
Kibana vulnerability analysis and mitigation
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
Source : NVD
## 5.7
Score
Published March 19, 2026
Severity MEDIUM
CNA Score 5.7
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 4.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-8.19
kibana-9.2
Sources
NVD
GoLang Severity MEDIUM Has Fix Added at: Mar 20, 2026
MinimOS Severity MEDIUM Has Fix Added at: Mar 26, 2026
Linux Severity MEDIUM Has Fix Added at: Mar 25, 2026
Window
Wiz
CVE-2026-26938 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26938 [MEDIUM] CVE-2026-26938 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26938 :
Kibana vulnerability analysis and mitigation
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Source : NVD
## 7.7
Score
Published February 26, 2026
Severity HIGH
CNA Score 8.6
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
cpe:2.3:a:ela
Wiz
CVE-2025-37732 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2025-37732 [HIGH] CVE-2025-37732 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-37732 :
Kibana vulnerability analysis and mitigation
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
Source : NVD
## 5.4
Score
Published December 15, 2025
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Kibana
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kibana-8.19
kibana-9.1
Sources
Chainguard Has Fix Added at:
Wiz
CVE-2026-26940 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26940 [MEDIUM] CVE-2026-26940 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26940 :
Kibana vulnerability analysis and mitigation
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.
Source : NVD
## 6.5
Score
Published March 19, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 17.4
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
kibana-9.2
kibana-9.3
Sou
Wiz
CVE-2026-26937 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.7
CVE-2026-26937 [MEDIUM] CVE-2026-26937 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26937 :
Kibana vulnerability analysis and mitigation
Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Source : NVD
## 7.5
Score
Published February 26, 2026
Severity HIGH
CNA Score 6.5
Affected Technologies
Kibana
MinimOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 17.5
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
cpe:2.3:a:elastic:kibana
kibana-8.19
Sources
MinimOS Severity HIGH Has Fix Added at: Mar 03, 2026
Nix Severity HIGH Has Fix Added at: Mar 03, 2026
Linux Severity HIGH Has Fix Added at: Mar 02, 2026
Windows Severity HIGH Has Fix Adde
2026-03-19
Published