Elastic Cloud Enterprise 1.1.4 security update

Elastic Cloud Enterprise use of shared encryption key ESA-2018-09 In Elastic Cloud Enterprise ECE versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable...

Elastic Stack 6.1.2 and 5.6.6 security update

Logstash sensitive information disclosure issue ESA-2018-01 When logging warnings regarding deprecated settings, Logstash could inadvertently log sensitive information. Affected Versions All versions before 6.1.2 and 5.6.6 Solutions and Mitigations: Users should upgrade to Logstash version 6.1.2 ...

About the Security Announcements category

Security announcements for the Elastic stack. To report a security vulnerability, please follow the instructions on ourSecurity Issues page. Posting to this category is restricted to staff only...

Elasticsearch 9.4.7, 9.5.3, 8.19.23 Security Update (ESA-2026-192)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to Denial of Service via Excessive Allocation CAPEC-130. Elasticsearch enforces a size limit on the user-suppli...

Elasticsearch 9.4.8, 9.5.5 Security Update (ESA-2026-190)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation CAPEC-130. Affected Versions: 9.x:...

Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy...

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to ...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-142)

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Where tw...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the...

Kibana 9.4.3 Security Update (ESA-2026-61)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. A user holding workflow edit permissions could cause scheduled workflow...

Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-160)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)

Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifa...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-120)

Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-119)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-63)

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in...

Elastic Stack 8.4.0, 7.17.6 Security Statement

Elastic Statement for Oracle July Critical Patch Update CVE-2022-21540, CVE-2022-21541, CVE-2022-21549, CVE-2022-25647, CVE-2022-34169 Summary : Oracle released their July Critical Patch Update for Java SE which contains 5 CVEs. Elastic has analyzed the flaws described by these CVEs and the...

APM Java Agent Security Update

APM Java Agent Local Privilege Escalation issue ESA-2021-30 A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at...

Kibana 6.1.1 security update

Kibana arbitrary code execution issue ESA-2017-24 Kibana version 6.1.0 had an arbitrary code execution vulnerability in the Math.js package which is used by math aggregations in Time Series Visual Builder. Kibana users could construct a math aggregation capable of executing arbitrary code on the...

Beats 5.6.4 security update

Packetbeat denial of service ESA-2017-21 Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could...

Kibana 5.5.2 and 4.6.5 security update

Kibana markdown parser Cross Site Scripting XSS error ESA-2017-16 Kibana versions prior to 5.5.2 had a cross-site scripting XSS vulnerability in the markdown parser that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users...

Elastic Stack 5.4.3 Security update

Kibana X-Pack Security user credentials disclosure ESA-2017-11 In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If the user enters credentials on this screen, the...

Elasticsearch directory traversal vulnerability CVE-2015-5531

Summary Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to retrieve files that are readable by the Elasticsearch JVM process. We have been assigned CVE-2015-5531 for this issue. Fixed versions Versions 1.6.1 and 1.7.0 address the...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth...

Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-115)

Uncaught Exception in Kibana Leading to Denial of Service Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana us...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-78)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no...

Kibana 9.4.4 Security Update (ESA-2026-70)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-68)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that...

Kibana 8.10.3, 7.17.14 Security Update

Kibana heap buffer overflow vulnerability ESA-2023-19 On Sept 11, 2023, Google Chrome announced CVE-2023-4863, described as “Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted...

Logstash 5.0.1 released with a security patch

Hi all, we would like to announce that Logstash 5.0.1 has been released with an important security patch. Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. We advise our users using Logstash and...

Kibana 4.4.2, 4.3.3, 4.1.6 - Updated node.js versions due to upstream vulnerabilities

Same deal as last month, but we've bumped all 3 version to node v4.3.2 to cover security issues in node.js. You can read their maintenance announcement here: https://nodejs.org/en/blog/release/v4.3.2/ Check out the blog post with release notes or grab the latest version...

Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)

Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)

Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier fo...

Kibana 8.19.20, 9.3.5, 9.4.2 Security Update (ESA-2026-136)

Uncaught Exception in Kibana Cases Leading to Denial of Service Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for...

Elasticsearch 7.17.14 / 8.10.3 Security Update (ESA-2023-24)

Elasticsearch Improper Handling of Exceptional Conditions ESA-2023-24 It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API. Affected Versions: Elasticsearch versions on or afte...

Elasticsearch 8.9.1 / 7.17.13 Security Update

Elasticsearch StackOverflow vulnerability ESA-2023-14 A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. Affected Versions: Elasticsearch versions from 7.0.0 to 7.17.12 and fr...

Elastic Security Statement for OpenSSL CVE-2022-3786 and CVE-2022-3602, OpenSSL version 3.0.7

Elastic Products are not affected by this issue. On Oct 25, 2022, Elastic became aware of the Forthcoming OpenSSL 3.0.7 Release announcement, which was made available on Nov 1, 2022. The security issues addressed in this release do not affect OpenSSL versions before 3.0. Elastic has performed an...

Elastic APM agent for Ruby 2.9.0 security update

Elastic APM agent for Ruby client authentication flaw ESA-2019-08 A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the ‘servercacert’ setting, the Ruby agent would not properly verify the certifica...

Elastic Cloud Enterprise 1.0.2 security update

Elastic Cloud Enterprise unsecured communication ESA-2017-13 The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle MITM the traffic between the client-forwarder and ZooKeeper they could...

X-Pack Security 5.6.0 and 5.5.3 security update

X-Pack Security permission issue ESA-2017-18 An error was found in the X-Pack Security privilege enforcement. If a user has either ‘delete’ or ‘index’ permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. Previously if a user had bulk...

Elastic Stack 5.5.1 and Kibana 4.6.5 security update

Kibana Node.js security flaw ESA-2017-14 The version of Node.js shipped in all versions of Kibana prior to 5.5.1 contains a Denial of Service flaw in it's HashTable random seed. This flaw could allow a remote attacker to consume resources within Node.js preventing Kibana from servicing requests...

Kibana 5.0.1 and 4.6.3 released with a fix for an open redirect vulnerability

Kibana versions 5.0.1 and 4.6.3 fix an open redirect vulnerability in the short URL feature that would allow an attacker to create a redirect from the Kibana domain to a different website. We’ve assigned this vulnerability the identifier ESA-2016-08. Thank you to the GE Digital Security Team for...