Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.
Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.
Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
CVE-2026-49095 is a high-severity vulnerability in Elastic Kibana affecting versions 8.0.0, 9.0.0, and 9.4.0. It involves improper input validation in the Fleet agent policy management feature, allowing an authenticated user with Fleet management privileges to manipulate agent policy configurations. This manipulation can result in Elastic Agents receiving API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive security indices. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits in the wild have been reported.
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.
CVE-2026-42401 is a medium severity vulnerability in Elastic Kibana involving improper neutralization of input during web page generation, leading to stored HTML injection (CWE-79). A user with write access to an Elasticsearch index can inject crafted markup that is not properly sanitized when rendered in Kibana views by other users. This can result in unauthorized UI manipulation and outbound network requests from the affected user's browser session. The vulnerability affects Kibana versions 8.0.0 and 9.0.0. No official patch or remediation guidance is currently available, and there are no known exploits in the wild.
CVE-2026-33463 is a medium severity vulnerability in Elastic Kibana versions 8.0.0 and 9.0.0 involving a logic error in expiration timestamp validation. This flaw allows a time-bounded access token to be used beyond its intended validity period, enabling an unauthenticated actor with the token to access associated content after expiration. The vulnerability is categorized as CWE-672, an operation on a resource after expiration or termination. There is no indication of known exploits in the wild or an official patch at this time.
CVE-2026-33464 is a medium severity vulnerability in Elastic Kibana affecting versions 8.0.0, 9.0.0, and 9.4.0. It involves uncontrolled resource consumption (CWE-400) where an authenticated user with low privileges can send an oversized payload to an internal API. This causes the Kibana process to exhaust system resources, leading to denial of service by making the service unresponsive until recovery or restart. There is no confirmed patch or official remediation available at this time.
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.
CVE-2026-33467 is a medium severity vulnerability in Elastic Package Registry version 0.1.0 involving improper verification of cryptographic signatures (CWE-347). This flaw could allow an attacker who can intercept network traffic or influence the contents served by a self-hosted registry to substitute a tampered package without triggering an integrity check failure. There is no official patch or remediation level provided by the vendor at this time, and no known exploits in the wild have been reported. The vulnerability impacts the integrity of packages distributed via the affected registry version.
CVE-2026-33466 is a path traversal vulnerability in Elastic Logstash version 8.0.0. The issue arises because the archive extraction utilities do not properly validate file paths within compressed archives. An attacker able to supply a specially crafted archive via a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with Logstash process privileges. If automatic pipeline reloading is enabled, this arbitrary file write can escalate to remote code execution. The vulnerability has a high severity score of 8.1 and affects confidentiality, integrity, and availability of the affected system.
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.
CVE-2026-33459 is a medium severity vulnerability in Elastic Kibana affecting versions 8.15.0, 9.0.0, and 9.3.0. It involves uncontrolled resource consumption (CWE-400) via the automatic import feature, where an authenticated user can submit requests with excessively large input values. Concurrent exploitation can destabilize backend services, causing denial of service and making the deployment unavailable to all users. There is no official patch or remediation level currently provided by the vendor.