Kibana 6.1.1 security update

Kibana arbitrary code execution issue ESA-2017-24 Kibana version 6.1.0 had an arbitrary code execution vulnerability in the Math.js package which is used by math aggregations in Time Series Visual Builder. Kibana users could construct a math aggregation capable of executing arbitrary code on the...

Elastic Stack 5.5 Security update

Elasticsearch X-Pack Security user credentials disclosure ESA-2017-10 Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as...

Protect your data from ransom attacks

I wanted to bring attention to two blog posts we have done recently in response to the recent set of data ransom attacks affecting Elasticsearch and other systems. The two are: For Elasticsearch: Protecting Against Attacks that Hold Your Data for Ransom For Kibana: Guarding Kibana from Data...

Kibana 5.0.2 released with a fix for improper authentication

With X-Pack installed, operations in the Advanced Settings panel of the Management tab and operations from the short URL service were performed as the "Kibana Server" user regardless of the user that is currently authenticated. As a result, a user that was defined as read-only could make changes ...

Logstash 2.3.2 Vulnerability with Netflow codec plugin

Hi all, we've published ESA-2016-06 for a vulnerability in netflow codec plugin for Logstash 2.3.2. Thanks to Jorrit Folmer maintainer of netflow codec for reporting and fixing this issue. Details below: Vulnerability Summary: In Logstash versions prior to 2.3.3, when using the Netflow Codec...

Kibana 4.x XSS -- CVE pending

Summary Kibana versions up to and including 4.3.0, 4.2.1, and 4.1.3 are vulnerable to a cross-site scripting XSS attack. The attack allows execution of arbitrary JavaScript in the context of the user’s browser. We have requested a CVE number and will update our forum post and website when the...

Kibana 3.1.3

We've identified two content sanitation issues in Kibana 3. While these are low impact and difficult to trigger we're releasing Kibana 3.1.3 to correct them: https://www.elastic.co/downloads/past-releases/kibana-3-1-3...

Elasticsearch directory traversal vulnerability CVE-2015-5531

Summary Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to retrieve files that are readable by the Elasticsearch JVM process. We have been assigned CVE-2015-5531 for this issue. Fixed versions Versions 1.6.1 and 1.7.0 address the...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)

Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated...

Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)

Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticate...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)

Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side scrip...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)

Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifa...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges ca...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-79)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-81)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-75)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint to submit a request that causes a self-referential data structure to be created. When a specific...

Elasticsearch 8.18.0, 9.0.0 Security Update (ESA-2026-111)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL...

X-Pack Security 5.6.0 and 5.5.3 security update

X-Pack Security permission issue ESA-2017-18 An error was found in the X-Pack Security privilege enforcement. If a user has either ‘delete’ or ‘index’ permissions on an index in a cluster, they may be able to issue both delete and index requests against that index. Previously if a user had bulk...

Kibana 4.6.2 released with a security fix for an XSS vulnerability

Today, we've published Kibana 4.6.2 as a security release with a fix for an XSS vulnerability with field formatters. Any users of Kibana versions 4.3 to 4.6 are encouraged to update to 4.6.2 immediately. Kibana version 4.1.11 is not affected. Kibana installs on Elastic Cloud have been updated...

Logstash 2.3.3 Elasticsearch Output Vulnerability

Hi all, we would like to announce a security vulnerability we discovered in our testing. Logstash 2.3.4 has been released with a patch to fix this. Issue Prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-175)

Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization CWE-863 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: 9.x: All versions from 9.0.0 up to and including 9.4....

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-140)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being us...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-156)

Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An...

Elastic Agent 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-150)

Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where...

Elasticsearch 8.19.19, 9.3.8, 9.4.4, 9.5.1 Security Update (ESA-2026-143)

Missing Authorization in Elasticsearch Leading to Information Disclosure Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana us...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-100)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)

Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier fo...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-133)

Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service Description: Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns agains...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-119)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-118)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes ECK operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without...

Kibana 8.19.20, 9.3.5, 9.4.2 Security Update (ESA-2026-136)

Uncaught Exception in Kibana Cases Leading to Denial of Service Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-174)

Incorrect Authorization in Kibana Leading to Denial of Service Incorrect Authorization CWE-863 in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.20 9.x: A...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-146)

Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-142)

Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Where tw...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-141)

Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' in Elasticsearch Leading to Information Disclosure Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under...

Elasticsearch 8.19.20, 9.3.0 Security Update (ESA-2026-47)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a special...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal...

Kibana 9.4.6 Security Update (ESA-2026-84)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user wit...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-123)

Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model,...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)

Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read...