Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

Elasticsearch 7.10.0-7.13.3 - Information Disclosure

ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as...

BIT-KIBANA-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

BIT-ELK-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

GO-2026-5343 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GO-2026-5932 vulnerabilities

Vulnerabilities for packages: terrafmt-fips, elastic-agent, terrafmt, elastic-agent-fips...

GO-2026-5544 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: frankenphp-8.5, cloudbeat, datadog-agent, vault-fips, kine, commercial-expanso-edge, datadog-agent-fips, zot, consul-fips, commercial-grafana, grafana-fips, frankenphp-8.3, elastic-agent, beats, rke2-runtime, frankenphp-8.4, mattermost-fips, loki, consul, vault,...

GO-2025-4252 vulnerabilities

Vulnerabilities for packages: apm-server-fips, beats-fips, cloudbeat, apm-server, elastic-agent, cloudbeat-fips...

GO-2023-2413 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, apm-server-fips, cloudbeat, apm-server, elastic-agent-fips, elastic-agent...

GO-2026-4360 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat, apm-server, cloudbeat-fips, beats...

GO-2025-4253 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, apm-server-fips, cloudbeat, apm-server, elastic-agent-fips, elastic-agent...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: falcosidekick-fips, dapr, telegraf, minio, beats-fips, agentbeat-fips, zabbix-agent2-fips, falcosidekick, minio-fips, elastic-agent-fips, influxd, dapr-fips, zabbix-agent2, agentbeat, bento, elastic-agent, beats...

CVE-2026-72665

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-72666

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

CVE-2026-72672

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

CVE-2026-72664

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

CVE-2026-72655

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-72630

Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...

EUVD-2026-58220

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...