Elastic Kibana vulnerabilities

CVE-2024-43710 [MEDIUM] CWE-918 CVE-2024-43710: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_che A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.

CVE-2025-68386 [MEDIUM] CWE-863 CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.

CVE-2026-33460 [MEDIUM] CWE-863 CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privi Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using a

CVE-2026-78606 [MEDIUM] CWE-863 CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and d Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's p

CVE-2017-8440 [MEDIUM] CWE-79 CVE-2017-8440: Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover pag Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVE-2017-8439 [MEDIUM] CWE-79 CVE-2017-8439: Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Buil Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.

CVE-2017-8451 [MEDIUM] CWE-601 CVE-2017-8451: With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

CVE-2018-3821 [MEDIUM] CWE-79 CVE-2018-3821: Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerabilit Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVE-2018-3820 [MEDIUM] CWE-79 CVE-2018-3820: Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVE-2017-11482 [MEDIUM] CWE-601 CVE-2017-11482: The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.

CVE-2021-22151 [MEDIUM] CWE-22 CVE-2021-22151: It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

CVE-2026-78581 [MEDIUM] CWE-639 CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data m Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own.

CVE-2021-37938 [MEDIUM] CWE-269 CVE-2021-37938: It was discovered that on Windows operating systems specifically, Kibana was not validating a user s It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Thanks to Dominic Couture for finding this vulnerability.

CVE-2026-82298 [MEDIUM] CWE-863 CVE-2026-82298: Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVE-2026-63259 [MEDIUM] CWE-639 CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclos Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

CVE-2026-49088 [MEDIUM] CWE-532 CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclos Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.

CVE-2022-23709 [MEDIUM] CWE-264 CVE-2022-23709: A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify a A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effecti

CVE-2024-37279 [MEDIUM] CWE-284 CVE-2024-37279: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.

CVE-2025-37734 [MEDIUM] CWE-346 CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP h Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

CVE-2020-7016 [MEDIUM] CWE-185 CVE-2020-7016: Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attac Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive.