EUVD-2026-58271

Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data...

CVE-2026-72659 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...

CVE-2026-72659

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...

CVE-2026-72659

Kibana is affected by CVE-2026-72659 through a vulnerability where a specially crafted payload submitted to a visualization can cause unbounded memory growth in the Kibana process, leading to denial of service. An authenticated, low-privileged user can trigger the issue, which makes Kibana unavai...

EUVD-2026-58270

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly...

CVE-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

EUVD-2026-58269

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658

CVE-2026-72658 describes a Cross-Site Request Forgery (CWE-352) in Kibana that can lead to privilege escalation when a user who can create visualizations saves a specially crafted Vega visualization. When another user opens that visualization, authenticated requests are issued in the viewing user...

CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

EUVD-2026-58268

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667

Kibana (Observability log analysis) is affected by CVE-2026-72667: an authenticated, low-privilege user can trigger unbounded concurrent work in a validation capability, exhausting Kibana memory and causing DoS. Affected: Kibana 8.0.0–8.19.19 and 9.0.0–9.4.4. Remediation: upgrade to 8.19.20 or 9....

CVE-2026-72666

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

CVE-2026-72665 Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who is able to author and evaluate Elastic Security detection rules can...

CVE-2026-72664

Kibana contains a Missing Authorization (CWE-862) vulnerability (CVE-2026-72664) that can allow unauthorized execution of Elastic Defend response actions on managed hosts when a user with only detection-rule privileges can link automated endpoint actions to a rule. The underlying issue is imprope...

EUVD-2026-58265

Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution c...

CVE-2026-72677

Kibana Fleet is affected by a Relative Path Traversal (CWE-23) that can enable unauthorized deletion of Kibana resources. The issue arises from accepting a user-supplied Fleet Server host configuration identifier without rejecting relative traversal sequences; the identifier is stored as provided...

CVE-2026-72677

Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored...

CVE-2026-72677 Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored...