Elastic Kibana vulnerabilities

CVE-2021-22142 [HIGH] CWE-1104 CVE-2021-22142: Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to gener Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage known Chromium vulnerabilities to conduct further attacks. Kibana contains a number of protect

CVE-2024-43706 [HIGH] CWE-285 CVE-2024-43706: Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Syntheti Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.

CVE-2026-42398 [HIGH] CWE-918 CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to b

CVE-2026-72669 [HIGH] CWE-862 CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who creat The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write

CVE-2026-82302 [HIGH] CWE-863 CVE-2026-82302: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVE-2026-72672 [HIGH] CWE-863 CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint po The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authent

CVE-2026-4498 [HIGH] CWE-250 CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can le Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).

CVE-2024-37285 [HIGH] CWE-502 CVE-2024-37285: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#role

CVE-2026-78590 [HIGH] CWE-22 CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kiban Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources

CVE-2026-49093 [HIGH] CWE-918 CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector manag Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

CVE-2026-33458 [HIGH] CWE-918 CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

CVE-2026-78592 [HIGH] CWE-22 CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana ca Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended targe

CVE-2026-49091 [HIGH] CWE-116 CVE-2026-49091: Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Inject Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content

CVE-2020-7013 [HIGH] CWE-94 CVE-2020-7013: Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

CVE-2023-31422 [HIGH] CWE-532 CVE-2023-31422: An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the e An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern. Elastic has released Kibana 8.10.1 which resolves this issue. The error object recorded in

CVE-2026-0528 [HIGH] CWE-129 CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a D Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper mo

CVE-2026-72677 [HIGH] CWE-23 CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the reque

CVE-2026-33462 [HIGH] CWE-22 CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An aut A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended

CVE-2026-72668 [HIGH] CWE-441 CVE-2026-72668: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to p Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author

CVE-2026-56147 [HIGH] CWE-639 CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized inform Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belo