1122 matches found
GO-2026-4910 vulnerabilities
Vulnerabilities for packages: flux-image-automation-controller, kubevela, cerbos, argocd-image-updater, apko, kubescape, guac, zarf, teleport, external-secrets-operator, snyk-cli, dagger, skaffold, gomplate, kaniko, gptscript, witness, pulumi-language-yaml, pulumi-kubernetes-operator, trivy, zot,...
GO-2026-5490 vulnerabilities
Vulnerabilities for packages: terragrunt, flux, cerbos, rancher-fleet, scorecard, teleport, syft, telegraf, external-secrets-operator, argo-cd, rclone, gitaly...
GO-2026-5597 vulnerabilities
Vulnerabilities for packages: terragrunt, cerbos, rancher-fleet, scorecard, teleport, syft, external-secrets-operator, argo-cd, rclone, gitaly...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-storage, q, gitlab-pages, crossplane-provider-aws-memorydb, neuvector-scanner, crossplane-provider-aws-sns, kubescape, conftest, crossplane-provider-aws-cloudfront, cri-tools, nri-apache, sigstore-scaffolding,...
CVE-2026-72676
Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...
CVE-2026-72677
Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored...
CVE-2026-72670
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...
CVE-2026-72657
Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...
CVE-2026-72632
Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...
CVE-2026-72630
Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the...
CVE-2026-72631
Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...
EUVD-2026-58221
Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...
CVE-2026-72632 Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...
CVE-2026-72632 Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys
Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...
CVE-2026-72632
Kibana Fleet vulnerability CVE-2026-72632 allows an information disclosure of Elasticsearch API keys through a side-channel in the agent listing API. Root cause: Fleet evaluated caller-supplied filter expressions against the stored API-key field using Kibana’s internal Elasticsearch privileges, l...
CVE-2026-72632
Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expression...
EUVD-2026-58220
Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...
CVE-2026-72631
Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...
CVE-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys
Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...