Elastic Kibana vulnerabilities

CVE-2026-72675 [HIGH] CWE-862 CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unautho Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separate

CVE-2026-0531 [MEDIUM] CWE-770 CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to pe

CVE-2026-0543 [MEDIUM] CWE-20 CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Exc Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially cr

CVE-2026-102412 [MEDIUM] CWE-863 CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessi Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative acces

CVE-2026-78582 [MEDIUM] CWE-862 CVE-2026-78582: Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting I Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Wher

CVE-2017-8452 [HIGH] CWE-775 CVE-2017-8452: Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cl Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over time until the process crashes.

CVE-2026-78591 [MEDIUM] CWE-22 CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kiban Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended tar

CVE-2026-26937 [HIGH] CWE-400 CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of S Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

CVE-2024-23446 [MEDIUM] CWE-284 CVE-2024-23446: An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Documen An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS agai

CVE-2026-63139 [MEDIUM] CWE-400 CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resul

CVE-2026-72644 [MEDIUM] CWE-248 CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation ( Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denyi

CVE-2026-72674 [MEDIUM] CWE-770 CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document

CVE-2026-72662 [MEDIUM] CWE-639 CVE-2026-72662: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclo Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline ob

CVE-2026-26936 [HIGH] CWE-1333 CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kib Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

CVE-2019-7618 [MEDIUM] CWE-538 CVE-2019-7618: A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malici A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user.

CVE-2026-72660 [MEDIUM] CWE-248 CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution pa

CVE-2026-78586 [MEDIUM] CWE-770 CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

CVE-2026-72682 [MEDIUM] CWE-770 CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and de

CVE-2026-72628 [MEDIUM] CWE-409 CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana pr

CVE-2026-72663 [MEDIUM] CWE-407 CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a