Elastic Kibana vulnerabilities

CVE-2026-49089 [MEDIUM] CWE-770 CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of servi Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating

CVE-2026-63261 [MEDIUM] CWE-400 CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

CVE-2026-72659 [MEDIUM] CWE-770 CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of servi Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request cause

CVE-2026-72651 [MEDIUM] CWE-770 CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of servi Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is suf

CVE-2026-82299 [MEDIUM] CWE-863 CVE-2026-82299: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorr Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

CVE-2026-42400 [MEDIUM] CWE-400 CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming un

CVE-2026-26934 [MEDIUM] CWE-1284 CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated a Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive o

CVE-2025-25010 [MEDIUM] CWE-863 CVE-2025-25010: Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user r Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.

CVE-2026-49094 [MEDIUM] CWE-400 CVE-2026-49094: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the

CVE-2025-37735 [HIGH] CWE-281 CVE-2025-37735: Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.

CVE-2023-46675 [MEDIUM] CWE-532 CVE-2023-46675: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in t An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, a

CVE-2026-63260 [MEDIUM] CWE-400 CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive me

CVE-2026-56151 [MEDIUM] CWE-20 CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipula Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.

CVE-2026-33465 [MEDIUM] CWE-770 CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

CVE-2026-72667 [MEDIUM] CWE-770 CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of conc

CVE-2026-42397 [MEDIUM] CWE-770 CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unav

CVE-2026-0530 [MEDIUM] CWE-770 CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.

CVE-2026-26940 [MEDIUM] CWE-1284 CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin i Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantit

CVE-2026-33464 [MEDIUM] CWE-400 CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users unti

CVE-2026-33459 [MEDIUM] CWE-400 CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable,