CVE-2026-33460 is an incorrect authorization vulnerability in Elastic Kibana affecting versions 8.0.0, 9.0.0, and 9.3.0. It allows a user with Fleet agent management privileges in one Kibana space to access Fleet Server policy details from other spaces. This occurs because an internal enrollment endpoint uses an unscoped internal client that bypasses space-scoped access controls, exposing operational identifiers, policy names, management states, and infrastructure linkage details from unauthorized spaces. The vulnerability has a medium severity with a CVSS score of 4.
CVE-2026-33461 is a high-severity vulnerability in Elastic Kibana affecting versions 8.0.0, 9.0.0, and 9.3.0. It involves incorrect authorization (CWE-863) where users with limited Fleet privileges can exploit an internal API to access sensitive configuration data, including private keys and authentication tokens. This occurs because the vulnerable endpoint returns full configuration objects without enforcing the proper authorization checks that are present in dedicated settings APIs. The vulnerability can lead to information disclosure but does not impact integrity or availability.
CVE-2026-4498 is a high-severity vulnerability in Elastic Kibana version 8.0.0 affecting the Fleet plugin. It involves execution with unnecessary privileges (CWE-250) in debug route handlers, allowing an authenticated Kibana user with Fleet sub-feature privileges to read Elasticsearch index data beyond their assigned RBAC scope. The vulnerability does not require user interaction but does require authentication with specific privileges. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
CVE-2026-26933 is a medium severity vulnerability in Elastic Packetbeat versions 8.0.0 and 9.0.0 caused by improper validation of array indices in multiple protocol parsers. An attacker on the same network segment or controlling routed traffic can send malformed packets that trigger out-of-bounds reads, leading to application crashes or resource exhaustion, resulting in denial of service. Exploitation does not require user interaction but does require low privileges and network access to monitored interfaces. No known exploits are currently reported in the wild. The vulnerability impacts availability but not confidentiality or integrity. Organizations using Packetbeat for network monitoring should prioritize patching or mitigating exposure to untrusted network traffic.
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.
Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network traffic. This requires an attacker to send a malformed payload to a monitored network interface where MongoDB protocol parsing is enabled.
CVE-2026-0543 is a medium-severity vulnerability in Elastic Kibana's Email Connector caused by improper input validation of email address parameters. An authenticated attacker with view-level privileges can exploit this flaw by submitting a specially crafted email address, triggering excessive memory allocation that leads to complete service unavailability. The denial-of-service condition persists until a manual restart of the Kibana service is performed. This vulnerability affects multiple Kibana versions including 7.0.0, 8.0.0, 9.0.0, and 9.
CVE-2026-0531 is a medium severity vulnerability in Elastic Kibana Fleet involving uncontrolled resource allocation. An attacker with low-level viewer privileges can send specially crafted bulk retrieval requests that cause redundant database operations, leading to excessive memory consumption. This results in a denial-of-service (DoS) condition by crashing the Kibana server and making it unavailable to all users. The vulnerability affects multiple Kibana versions from 7.10.0 through 9.2.0. No user interaction is required beyond possessing viewer-level access, and no known exploits are currently in the wild. The vulnerability impacts availability but does not compromise confidentiality or integrity.
CVE-2026-0530 is a medium severity vulnerability in Elastic Kibana Fleet affecting versions 7.10.0, 8.0.0, 9.0.0, and 9.2.0. It involves allocation of resources without limits or throttling (CWE-770), allowing an attacker with low privileges to send specially crafted requests that cause redundant processing and excessive resource consumption.
CVE-2026-0528 is a medium severity vulnerability in Elastic Metricbeat affecting versions 7.0.0 through 9.2.0. It involves improper validation of array indices (CWE-129) in the Graphite and Zookeeper server metricsets, and improper input validation (CWE-20) in the Prometheus helper module. An attacker can exploit this by sending specially crafted malformed payloads or metric data, causing a Denial of Service (DoS) condition. The vulnerability requires network access but no authentication or user interaction. While no known exploits are currently in the wild, the flaw can disrupt metric collection and monitoring services. European organizations relying on Metricbeat for infrastructure monitoring may experience service outages or degraded observability.
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.