Elastic Kibana vulnerabilities

CVE-2016-1000220 [MEDIUM] CWE-79 CVE-2016-1000220: Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execu Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

CVE-2022-38779 [MEDIUM] CWE-601 CVE-2022-38779: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arb An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

CVE-2020-7015 [MEDIUM] CWE-79 CVE-2020-7015: Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An atta Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization.

CVE-2025-25016 [MEDIUM] CWE-434 CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

CVE-2026-78593 [MEDIUM] CWE-94 CVE-2026-78593: An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticate An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.

CVE-2026-78596 [MEDIUM] CWE-862 CVE-2026-78596: Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform priv

CVE-2018-3830 [MEDIUM] CWE-79 CVE-2018-3830: Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field f Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVE-2019-7608 [MEDIUM] CWE-79 CVE-2019-7608: Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could al Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.

CVE-2015-9056 [MEDIUM] CWE-79 CVE-2015-9056: Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack. Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.

CVE-2022-23710 [MEDIUM] CWE-79 CVE-2022-23710: A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.

CVE-2025-25017 [MEDIUM] CWE-79 CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripti Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

CVE-2025-68385 [MEDIUM] CWE-79 CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.

CVE-2019-7621 [MEDIUM] CWE-79 CVE-2019-7621: Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate a Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaSc

CVE-2022-23707 [MEDIUM] CWE-79 CVE-2022-23707: An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users

CVE-2024-23443 [MEDIUM] CWE-400 CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of K A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

CVE-2021-37936 [MEDIUM] CWE-79 CVE-2021-37936: It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using thi It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.

CVE-2025-25009 [MEDIUM] CWE-79 CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via cas Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

CVE-2025-25018 [MEDIUM] CWE-79 CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

CVE-2025-37732 [MEDIUM] CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

CVE-2026-72650 [MEDIUM] CWE-639 CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclos Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not