BIT-KIBANA-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

BIT-ELK-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

BIT-ELK-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

BIT-ELK-2026-72661 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint...

PT-2026-79954

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

PT-2026-79888

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

PT-2026-79948

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

PT-2026-79890

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

PT-2026-79947

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

GO-2026-5343 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GO-2026-5544 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GO-2026-5932 vulnerabilities

Vulnerabilities for packages: terrafmt, elastic-agent-fips, terrafmt-fips, peerdb-flow, elastic-agent, peerdb-flow-fips...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: beats-fips, fuse-overlayfs-snapshotter, commercial-expanso-edge, frankenphp-8.3, commercial-grafana, datadog-agent, elastic-agent-fips, frankenphp-8.2, datadog-agent-fips, elastic-agent, grafana-fips, rke2-runtime, mattermost-fips, k3s, frankenphp-8.5, loki,...

GO-2025-4252 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat-fips, beats-fips, cloudbeat, apm-server, elastic-agent...

GO-2026-4360 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat-fips, cloudbeat, apm-server, beats...

GO-2023-2413 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat-fips, cloudbeat, apm-server, elastic-agent-fips, elastic-agent...

GO-2025-4253 vulnerabilities

Vulnerabilities for packages: apm-server-fips, cloudbeat-fips, cloudbeat, apm-server, elastic-agent-fips, elastic-agent...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: dapr, falcosidekick-fips, zabbix-agent2-fips, beats-fips, zabbix-agent2, minio, falcosidekick, telegraf, influxd, elastic-agent-fips, minio-fips, agentbeat-fips, bento, elastic-agent, dapr-fips, agentbeat, beats...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via the response actions. An attacker can execute unauthorized actions on managed hosts by associating...

CVE-2026-72665

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...