GO-2023-2413 vulnerabilities

Vulnerabilities for packages: apm-server, apm-server-fips, elastic-agent-fips, cloudbeat, elastic-agent, cloudbeat-fips...

GO-2025-4253 vulnerabilities

Vulnerabilities for packages: apm-server, apm-server-fips, elastic-agent-fips, cloudbeat, elastic-agent, cloudbeat-fips...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: beats-fips, minio, minio-fips, dapr-fips, elastic-agent-fips, zabbix-agent2, beats, dapr, telegraf, bento, influxd, elastic-agent, agentbeat, zabbix-agent2-fips, agentbeat-fips, falcosidekick-fips, falcosidekick...

CVE-2026-72631

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

EUVD-2026-58220

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-72631 Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys

Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolle...

CVE-2026-72631

Kibana Fleet vulnerability CVE-2026-72631: Improper Privilege Management can allow an Elastic Agent API key issued to agents in a policy to gain additional write rights (insert new documents and extend index mappings) for certain indices by including extra data streams in the integration policy. ...

CVE-2026-72666

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: upwind-agent, kyverno, cert-manager, omnictl-multiarch-fips, commercial-expanso-edge, omnictl-multiarch, reports-server, k3s, kaf, spire-server, cilium, zitadel, zot, k3d, containerd, telegraf, kots, minio, elastic-agent-fips, flux, backup-restore-operator,...

GHSA-PJV4-3C63-699F vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

CVE-2026-42602 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-HJ4R-2C9C-29H3 vulnerabilities

Vulnerabilities for packages: apm-server, apm-server-fips, elastic-agent-fips, cloudbeat, elastic-agent, cloudbeat-fips...

CVE-2023-49922 vulnerabilities

Vulnerabilities for packages: apm-server, apm-server-fips, elastic-agent-fips, cloudbeat, elastic-agent, cloudbeat-fips...

CVE-2026-48496 vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-F2R5-5M7W-P5CX vulnerabilities

Vulnerabilities for packages: elastic-agent, elastic-agent-fips...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: upwind-agent, gatekeeper, kubescape-server-fips, argo-workflows, drone, k9s, reports-server, kaf, opentofu-fips, coder, flux-source-controller-fips, grafana, fscrypt, gitea-fips, keda-fips, tekton-pipelines, cloudbeat, skaffold, commercial-grafana, seaweedfs-rocksdb,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: external-secrets-fips, cert-manager-csi-driver-fips, cert-manager-cmctl-fips, dex, opentofu-fips, cert-manager-istio-csr-fips, syncthing-fips, agentbeat, flux-source-controller-fips, grafana, seaweedfs, gitea-fips, juicefs, cloudbeat, kyverno-notation-aws-fips,...

CVE-2026-33817 vulnerabilities

Vulnerabilities for packages: grafana-fips, mattermost, rke2-runtime, beats, datadog-agent, elastic-agent, commercial-expanso-edge, k3s, frankenphp-8.5, vault, zot, rke2-runtime-fips, containerd, frankenphp-8.4, datadog-agent-fips, grafana, beats-fips, elastic-agent-fips, frankenphp-8.3,...