Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-87 / ESA-2026-88)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-87 and ESA-2026-88 advisories. - A lower privileged user who holds only the privilege to read agent policies can...

PT-2026-79893

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization via the Fleet proxy configuration. An attacker can access sensitive proxy authentication credentials and...

CVE-2026-72670

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

CVE-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

CVE-2026-72670

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

CVE-2026-72670

CVE-2026-72670 affects Kibana with Fleet: a lower-privileged user who can read agent policies can access the entire Fleet proxy configuration, potentially exposing proxy credentials and private keys. The Elastic advisory confirms affected versions: all up to 8.19.19 and 9.0.0–9.4.4, with remediat...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet...

CVE-2026-72670: Exposure of Sensitive Information to an Unauthorized Actor

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

PT-2026-71780

Name of the Vulnerable Software and Affected Versions Fleet affected versions not specified Description A user with low privileges, specifically those only authorized to read agent policies, can access the complete configuration of a configured Fleet proxy. This action typically requires the Flee...

MAL-2026-6134 Malicious code in panrouter-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 390c706978c9207807a0aeb4b1e3dfc500847828c23f5ffb06a14171ca8e51e6 panrouter-admin ships relayclient.cjs, which connects to a hardcoded WebSocket endpoint at wss://jiuling.xyz/ws, registers the host with an identity ...