Kibana 9.4.5 Security Update (ESA-2026-147)

Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing a...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-146)

Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace...

AZL-98445 CVE-2026-78607 affecting package rubygem-elasticsearch 8.9.0-1

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

CVE-2026-78607

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

CVE-2026-72654

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

EUVD-2026-69570

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

CVE-2026-78607

Elasticsearch custom inference service is affected by a Missing Authorization flaw (CWE-862) that allows a user with only inference execution privileges to redirect outbound inference traffic to an arbitrary destination and expose administrator-provisioned credentials . Affected versions are 8.0....

CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure

Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...

EUVD-2026-69569

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

EUVD-2026-69567

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654

CVE-2026-72654 is an Execution with Unnecessary Privileges (CWE-250) vulnerability in the Kibana machine learning feature . An operation available to users with only read access to the ML feature was executed using an internal service identity rather than the requesting user's own identity, allow...

Elasticsearch 8.19.19, 9.3.8, 9.4.4, 9.5.1 Security Update (ESA-2026-143)

Missing Authorization in Elasticsearch Leading to Information Disclosure Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference...

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84397

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Missing authorization in the custom inference service allows a user with only inference execution privileges to redirect outbound inference traffic to an arbitrary destination. This...

Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...

MAL-2026-15603 Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...