CVE-2026-72667 is a vulnerability in Kibana where resource allocation occurs without limits or throttling. An authenticated user with minimal privileges can submit a specially crafted request to the Observability log analysis feature, causing unbounded concurrent work. This can exhaust Kibana's memory, leading to denial of service until the service is restarted. The impact varies with deployment resources; well-provisioned systems may experience degraded performance rather than full outages. The vulnerability affects Kibana versions 8.0.0 up to but not including 8.19.20 and 9.0.0 up to but not including 9.4.5. A patch is available to address this issue.
CVE-2026-72666 is an authorization bypass vulnerability in Kibana that allows a user authorized to run Osquery live queries in one Kibana space to execute queries on Elastic Agents assigned to other spaces without proper access. This leads to unauthorized disclosure of information from hosts in those other spaces. The issue arises from improper access control enforcement related to user-controlled keys. A patch is available for affected versions.
A missing authorization vulnerability in Kibana allows users who can author and evaluate Elastic Security detection rules to execute Osquery and Elastic Defend response actions on managed hosts without proper privileges. This flaw enables unauthorized execution of response actions that could disclose information or alter the state of affected hosts. The issue affects Kibana versions from 8.5.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.
A missing authorization vulnerability in Kibana allows users with detection rule authoring privileges to execute Elastic Defend endpoint response actions without having the necessary dedicated endpoint response action privileges. This flaw enables unauthorized execution of actions such as host isolation and process operations when detection rules trigger alerts. The issue affects Kibana versions from 8.9.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.
CVE-2026-72663 is a vulnerability in Kibana where inefficient algorithmic complexity in processing deeply nested expressions in TSVB visualizations can cause denial of service. A crafted input causes synchronous evaluation that consumes the request-processing thread indefinitely, making Kibana unresponsive until restarted. This affects Kibana versions from 8.0.0 up to but not including 8.19.20 and from 9.0.0 up to but not including 9.4.5. A patch is available to address this issue. No known exploits are reported in the wild.
A missing authorization vulnerability in Kibana allows authenticated low-privileged users to access endpoint response action records and response content without proper permissions. This occurs because an internal data retrieval function used by Elastic Defend endpoint response actions does not enforce required Security Solution and endpoint privileges, instead retrieving data with elevated internal permissions. The issue affects multiple Kibana versions from 8.12.0 up to but not including 8.19.19, 9.0.0 up to 9.3.8, and 9.4.0 up to 9.4.4. A patch is available to address this vulnerability. No known exploits are reported in the wild.
CVE-2026-72660 is a vulnerability in Kibana where an uncaught exception caused by improper input validation can lead to a denial of service. An authenticated user with low privileges can supply specially crafted data that triggers an internal error, causing the Kibana process to terminate. This results in service unavailability until the system is restarted. The issue affects multiple Kibana versions prior to specific fixed releases. No known exploits are reported in the wild, and a patch is available.
A vulnerability in Kibana allows authenticated users with low privileges to submit specially crafted malformed payloads to the visualization feature, causing unbounded memory allocation. This leads to the Kibana process being terminated by the host due to exhaustion of available memory, resulting in denial of service until the service is restarted. The issue affects Kibana versions 8.0.0 up to but not including 8.19.20, and 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.
A Cross-Site Request Forgery (CSRF) vulnerability in Kibana allows a user with permission to create visualizations to save a malicious Vega visualization. When another user opens this visualization, it triggers authenticated requests in the context of the viewing user's session, potentially leading to privilege escalation. This affects Kibana versions from 8.19.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this issue.
A vulnerability in Kibana's Elastic Security case management allows authenticated users without case editing privileges to modify case data. This occurs because the case management API does not enforce the same authorization checks as the user interface, enabling low-privileged users to alter case records they should only view. The issue affects versions 8.0.0 up to but not including 8.19.20, and 9.0.0 up to but not including 9.4.5. A patch is available to address this improper authorization enforcement.
CVE-2026-72653 is a medium severity vulnerability in Kibana where an authenticated user authorized to manage maintenance windows can submit a specially crafted payload that causes excessive resource allocation. This leads to denial of service as the Kibana process becomes unresponsive and requires manual intervention to recover. The issue affects multiple Kibana versions from 8.12.0 up to but not including 8.19.19, 9.0.0 up to 9.3.8, and 9.4.0 up to 9.4.4. A patch is available to address this vulnerability.
CVE-2026-72651 is a medium severity vulnerability in Kibana where an authenticated user with read-only alerting privileges can submit a malformed payload that causes excessive resource consumption. This resource exhaustion leads to denial of service, making Kibana unresponsive until the process is restarted. The issue affects Kibana versions 8.0.0 up to but not including 8.19.20, and 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.
CVE-2026-72650 is an authorization bypass vulnerability in Kibana that allows an authenticated user with read access to alerting rules in one space to access alerting rule execution telemetry from other spaces they are not authorized to view. The disclosed information includes rule identifiers, names, space identifiers, execution outcomes, timestamps, and counters. This vulnerability affects Kibana versions 8.0.0 up to but not including 8.19.20, and 9.0.0 up to but not including 9.4.5. A patch is available to address this issue. No known exploits are reported in the wild. The severity is assessed as medium based on the impact of unauthorized information disclosure.
CVE-2026-72643 is a high severity vulnerability in Kibana Agent Builder where incorrect authorization logic allows users to access and modify private agents they do not own. The flaw arises because ownership is determined by comparing a stable user identifier or, if absent, the username. Since usernames are not unique across Elasticsearch authentication realms, distinct users with the same username in different realms are treated as the same owner. This leads to unauthorized disclosure and tampering of private agent configurations and instructions.
A vulnerability in Kibana Fleet allows an attacker to reconstruct Elasticsearch API keys of enrolled Elastic Agents via a side-channel attack. The flaw arises because Fleet removes API key values from agent listing responses but accepts caller-supplied filter expressions evaluated with elevated privileges. By observing the number of matching agents for crafted filters, an attacker can infer the API key characters one at a time.
CVE-2026-72631 is a medium severity vulnerability in Kibana Fleet involving improper privilege management. It allows over-scoped Elastic Agent API keys to be issued, granting privileges to insert new documents and extend index mappings on specific indices. The vulnerability does not permit reading, updating, or deleting existing documents. Affected versions include Kibana >=9.1.0 <9.4.5 and >=9.5.0 <9.5.1. A patch is available to address this issue.
CVE-2026-72630 is a high-severity vulnerability in Kibana Fleet involving incorrect authorization that allows privilege escalation. The flaw occurs because Fleet restricts management of integration policies to specific integrations, but when updating an existing policy, the authorization check is performed against the stored integration rather than the new integration supplied. This enables an authenticated user with Elastic Defend endpoint policy management privileges to convert an endpoint policy they control into a policy for a different integration and supply that integration's configuration.
CVE-2026-72629 is a high-severity authorization bypass vulnerability in Kibana that allows unauthorized cross-space access to machine learning trained models. The flaw arises from improper access control checks on a user-controlled key, enabling attackers to view inference outputs from models in spaces they are not authorized to access. Additionally, attackers can stop or update active model deployments in other spaces, potentially disrupting operations or altering resource allocation. This vulnerability affects specific Kibana versions from 8.19.0 up to but not including 8.19.20, 9.0.0 up to but not including 9.4.5, and 9.5.0 up to but not including 9.5.1. A patch is available to address this issue.
A vulnerability in Kibana Cases allows an authenticated user with commenting privileges to cause a denial of service by submitting a malformed link syntax in a case comment. This malformed comment is not sanitized or rejected and triggers an unhandled exception when the case is viewed, rendering the case inaccessible to all users until the comment is removed. The issue affects multiple Kibana versions prior to specific fixed releases.
A vulnerability in Kibana allows an authenticated user with read-only privileges to cause a denial of service by sending a query expression without limits on its size. This oversized expression causes the Kibana process to spend an unbounded amount of time evaluating it, rendering the service unavailable until restarted. The issue affects Kibana versions from 8.0.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this resource allocation flaw.