PT-2026-32409

Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...

PT-2026-32432

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...

PT-2026-32407

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

PT-2026-32433

Execution with Unnecessary Privileges CWE-250 in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse CAPEC-122. This requires an authenticated Kibana user with Fleet sub-feature privileges such as agents, agent...

PT-2026-32408

Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: kuma, helm-push, cert-manager-cmctl, zarf, rancher-fleet, cilium-cli, flux, flux-source-controller, kots...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: kuma, helm-push, cert-manager-cmctl, zarf, rancher-fleet, cilium-cli, flux, flux-source-controller, kots...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: kuma, helm-push, cert-manager-cmctl, zarf, rancher-fleet, cilium-cli, flux, flux-source-controller, kots...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: kuma, helm-push, cert-manager-cmctl, zarf, rancher-fleet, cilium-cli, flux, flux-source-controller, kots...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, helm, nova, harbor, rancher-fleet, pluto, trivy-operator, tigera-operator, helm-push, helm-set-status, zarf, cilium-cli, flux, chart-testing, kube-arangodb, kuma, linkerd2, cert-manager-cmctl, k9s, envoy-gateway, helm-mapkubeapis,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, helm, nova, harbor, rancher-fleet, pluto, trivy-operator, tigera-operator, helm-push, helm-set-status, zarf, cilium-cli, flux, chart-testing, kube-arangodb, kuma, linkerd2, cert-manager-cmctl, k9s, envoy-gateway, helm-mapkubeapis,...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, kots, helm-diff, flux-source-controller-fips, flux-source-controller, zarf, cert-manager-cmctl-fips, flux, flux-fips, kuma, rancher-fleet-fips, helm-diff-fips, cilium-cli, helm-push, zarf-fips, gitlab-operator, rancher-fleet, cert-manager-cmctl...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, kots, helm-diff, flux-source-controller-fips, flux-source-controller, zarf, cert-manager-cmctl-fips, flux, flux-fips, kuma, rancher-fleet-fips, helm-diff-fips, cilium-cli, helm-push, zarf-fips, gitlab-operator, rancher-fleet, cert-manager-cmctl...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, kots, helm-diff, flux-source-controller-fips, flux-source-controller, zarf, cert-manager-cmctl-fips, flux, flux-fips, kuma, rancher-fleet-fips, helm-diff-fips, cilium-cli, helm-push, zarf-fips, gitlab-operator, rancher-fleet, cert-manager-cmctl...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, kots, helm-diff, flux-source-controller-fips, flux-source-controller, zarf, cert-manager-cmctl-fips, flux, flux-fips, kuma, rancher-fleet-fips, helm-diff-fips, cilium-cli, helm-push, zarf-fips, gitlab-operator, rancher-fleet, cert-manager-cmctl...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: chaos-mesh, kots, envoy-gateway-fips, kuma, kubescape-server-fips, jfrog-cli, helm-diff-fips, cloudbeat, envoy-gateway, kubescape-server, cerbos, k8ssandra-client, helm, consul-k8s-fips, linkerd2-fips, gitlab-operator, rancher-fleet, tigera-operator-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: karpenter-fips, prometheus, commercial-chainloop-backend, k8ssandra-client, coredns-fips, eksctl, neuvector-scanner-fips, gatekeeper-fips, gitlab-kas, mattermost, flux-helm-controller-fips, tkn, tofu-controller-fips, trivy, flux-fips, ingress-nginx-controller-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: karpenter-fips, prometheus, commercial-chainloop-backend, k8ssandra-client, coredns-fips, eksctl, neuvector-scanner-fips, gatekeeper-fips, gitlab-kas, mattermost, flux-helm-controller-fips, tkn, tofu-controller-fips, trivy, flux-fips, ingress-nginx-controller-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, karpenter-fips, prometheus, prometheus-redis-exporter-fips, db-operator, commercial-chainloop-backend, kubernetes-csi-livenessprobe, crossplane-provider-aws-rolesanywhere-fips, nri-discovery-kubernetes, rancher-webhook, request-1279,...

Kibana 8.x < 8.19.14 / 9.0.x < 9.2.8 / 9.3.x < 9.3.3 Multiple Vulnerabilities (ESA-2026-21 / ESA-2026-24 / ESA-2026-25 / ESA-2026-26)

The version of Kibana installed on the remote host is prior to 8.19.14, 9.2.8, or 9.3.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-21, ESA-2026-24, ESA-2026-25, and ESA-2026-26 advisories. - An incorrect authorization vulnerability in Kibana Fleet allows...