CVE-2026-56152

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

EUVD-2026-41087

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152 Incorrect Authorization in Elastic Defend Leading to Information Disclosure

Incorrect Authorization CWE-863 in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to vie...

CVE-2026-56152

Summary: CVE-2026-56152 concerns Elastic Defend. Affected component is the Elastic Defend response actions where an authorization check failure allowed a low-privileged authenticated user to access response action data they should not view (CWE-863, CAPEC-1). Impact details (as described): The vu...

GHSA-PJV4-3C63-699F vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

CVE-2026-42602 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

PT-2026-54867

Name of the Vulnerable Software and Affected Versions Elastic Defend affected versions not specified Description Incorrect authorization allows a low-privileged authenticated user to access response action data they are not authorized to view. This occurs because functionality is not properly...

GHSA-HJ4R-2C9C-29H3 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat, cloudbeat-fips, elastic-agent-fips...

CVE-2023-49922 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat, cloudbeat-fips, elastic-agent-fips...

CVE-2026-48496 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-F2R5-5M7W-P5CX vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: upwind-agent, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, traefik, tekton-pipelines, skaffold, terraform, tekton-pipelines-fips, aactl, mattermost, argo-workflows-fips, vitess, knative-kafka-broker-fips, cilium-cli, drone-fips, helm, etcd-fips,...

GO-2026-5611 Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry

Elastic Package Registry has Improper Verification of Cryptographic Signature in github.com/elastic/package-registry...

EUVD-2026-39356

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...

CVE-2026-40012

The vulnerability CVE-2026-40012 affects configurations with ECS enabled, where ECS zero-scoped answers are stored in the packet cache instead of being properly restricted, potentially leaking to clients. The issue has a network-based attack surface with low confidentiality impact (CVSS v3.1: 5.3...

CVE-2026-40012

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...

CVE-2026-40012 Information about ECS zero scoped answers might leak to clients that use a specific ECS

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...

CVE-2026-40012

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;...

CVE-2026-57295

CVE-2026-57295 describes a CSRF vulnerability in Jenkins EC2 Fleet Plugin (versions up to 4.2.3.539.v8fedff2a_81c3 and earlier). The issue lets an attacker cause Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained by another method, potentially captur...