Kibana 4.4.1, 4.3.2, 4.1.5 - Updated node.js versions due to upstream vulnerabilities

Summary: The bundled versions of node.js in Kibana contain HTTP-related security vulnerabilities. Fixed versions of node.js were recently released. For the original node.js security announcement, see https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/ Fixed versions: Kibana...

Kibana Cross-site Request Forgery CVE-2015-8131

CVE: CVE-2015-8131 Affected versions: All versions up to and including 4.1.2 and 4.2.0. The vulnerability is a cross-site request forgery CSRF or XSRF that could allow an attacker to read and write changes to the .kibana index or gain read and write access to Kibana plugin actions. Remediation: A...

Kibana Cross-Site Scripting Vulnerability CVE-2015-4093

Summary: Kibana versions 4.0.0, 4.0.1 and 4.0.2 are vulnerable to a cross-site scripting XSS attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser. We have been assigned CVE-2015-4093 for this issue. Fixed versions: Version 4.0.3 has addressed the...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...

Kibana 9.4.4 Security Update (ESA-2026-73)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. Affected Versions: 9.4.x: All versions from 9.4.0 up to and...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-72)

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-63)

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in...

Elasticsearch Security Statement regarding CVE-2022-1471

Elasticsearch is not affected by this issue. Elasticsearch is not affected by the issue described in CVE-2022-1471 as, in general, it does not use Snakeyaml to parse YAML. Summary Elasticsearch supports YAML as a format for search queries, and it also uses YAML for its configuration files i.e...

Elastic Stack 7.5.0 security update

Metricbeat and Filebeat DSA public key panic ESA-2019-15 A denial of service flaw when parsing malformed DSA public keys was discovered in Go, the language used to implement Beats. If Metricbeat or Filebeat are configured to accept incoming TLS connections with client authentication enabled, a...

X-Pack Security 5.6.0 and 5.5.3 security update

X-Pack Security permission issue ESA-2017-18 An error was found in the X-Pack Security privilege enforcement. If a user has either ‘delete’ or ‘index’ permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. Previously if a user had bulk...

Elastic Stack 5.5 Security update

Elasticsearch X-Pack Security user credentials disclosure ESA-2017-10 Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as...

Logstash 5.0.1 released with a security patch

Hi all, we would like to announce that Logstash 5.0.1 has been released with an important security patch. Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. We advise our users using Logstash and...

Logstash 2.3.2 Vulnerability with Netflow codec plugin

Hi all, we've published ESA-2016-06 for a vulnerability in netflow codec plugin for Logstash 2.3.2. Thanks to Jorrit Folmer maintainer of netflow codec for reporting and fixing this issue. Details below: Vulnerability Summary: In Logstash versions prior to 2.3.3, when using the Netflow Codec...

Logstash CSV Output Vulnerability - CVE pending

Summary: Logstash 2.2 and prior versions are vulnerable to a formula based injection, when using the CSV output plugin. This plugin allows users to export data in comma separated values and is susceptible to an attack if the values contained a spreadsheet formula. This vulnerability is not presen...

Kibana 4.x XSS -- CVE pending

Summary Kibana versions up to and including 4.3.0, 4.2.1, and 4.1.3 are vulnerable to a cross-site scripting XSS attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser. We have requested a CVE number and will update our forum post and website when the...

Elasticsearch directory traversal vulnerability CVE-2015-5531

Summary Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to retrieve files that are readable by the Elasticsearch JVM process. We have been assigned CVE-2015-5531 for this issue. Fixed versions Versions 1.6.1 and 1.7.0 address the...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-113)

Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve...

Elasticsearch 8.19.18, 9.3.7, 9.4.4 Security Update (ESA-2026-57)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user with permission to execute EQL sequence queries against ...

Elasticsearch 8.13.0 / 7.17.19 Security Update (ESA-2024-06)

Elasticsearch Uncontrolled Resource Consumption vulnerability ESA-2024-06 A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash. Affected Versions: Elasticsearch versions on or after 7.0.0 and...

Protect your data from ransom attacks

I wanted to bring attention to two blog posts we have done recently in response to the recent set of data ransom attacks affecting Elasticsearch and other systems. The two are: For Elasticsearch: Protecting Against Attacks that Hold Your Data for Ransom For Kibana: Guarding Kibana from Data...

Kibana 5.0.2 released with a fix for improper authentication

With X-Pack installed, operations in the Advanced Settings panel of the Management tab and operations from the short URL service were performed as the "Kibana Server" user regardless of the user that is currently authenticated. As a result, a user that was defined as read-only could make changes ...

Kibana 4.6.2 released with a security fix for an XSS vulnerability

Today, we've published Kibana 4.6.2 as a security release with a fix for an XSS vulnerability with field formatters. Any users of Kibana versions 4.3 to 4.6 are encouraged to update to 4.6.2 immediately. Kibana version 4.1.11 is not affected. Kibana installs on Elastic Cloud have been updated...

Logstash 2.3.3 Elasticsearch Output Vulnerability

Hi all, we would like to announce a security vulnerability we discovered in our testing. Logstash 2.3.4 has been released with a patch to fix this. Issue Prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Kibana 3.1.3

We've identified two content sanitation issues in Kibana 3. While these are low impact and difficult to trigger we're releasing Kibana 3.1.3 to correct them: https://www.elastic.co/downloads/past-releases/kibana-3-1-3...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-127)

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation Description: Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an...

Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-120)

Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit...

Elastic Stack 5.5.1 and Kibana 4.6.5 security update

Kibana Node.js security flaw ESA-2017-14 The version of Node.js shipped in all versions of Kibana prior to 5.5.1 contains a Denial of Service flaw in it's HashTable random seed. This flaw could allow a remote attacker to consume resources within Node.js preventing Kibana from servicing requests...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that...

Kibana 9.4.5 Security Update (ESA-2026-89)

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead o...

Kibana 9.4.4 Security Update (ESA-2026-83)

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when i...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet...

Kibana 8.19.19 and 9.4.5 Security Update (ESA-2026-86)

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges ca...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-81)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and...

Elasticsearch 8.18.0, 9.0.0 Security Update (ESA-2026-111)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL...

Kibana 9.4.5 Security Update (ESA-2026-97)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by t...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-106)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with read-only privileges to the alerting...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-105)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-104)

Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service Description: Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization i...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-100)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a...

Kibana 8.19.20, and 9.4.4 Security Update (ESA-2026-90)

Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user wit...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)

Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend...