Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)

Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read...

Kibana 9.4.3 Security Update (ESA-2026-61)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. A user holding workflow edit permissions could cause scheduled workflow...

Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the...

Kibana 9.4.6 Security Update (ESA-2026-84)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)

Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend...

Protect your data from ransom attacks

I wanted to bring attention to two blog posts we have done recently in response to the recent set of data ransom attacks affecting Elasticsearch and other systems. The two are: For Elasticsearch: Protecting Against Attacks that Hold Your Data for Ransom For Kibana: Guarding Kibana from Data...

Kibana 5.0.2 released with a fix for improper authentication

With X-Pack installed, operations in the Advanced Settings panel of the Management tab and operations from the short URL service were performed as the "Kibana Server" user regardless of the user that is currently authenticated. As a result, a user that was defined as read-only could make changes ...

Kibana 4.6.2 released with a security fix for an XSS vulnerability

Today, we've published Kibana 4.6.2 as a security release with a fix for an XSS vulnerability with field formatters. Any users of Kibana versions 4.3 to 4.6 are encouraged to update to 4.6.2 immediately. Kibana version 4.1.11 is not affected. Kibana installs on Elastic Cloud have been updated...

Kibana 3.1.3

We've identified two content sanitation issues in Kibana 3. While these are low impact and difficult to trigger we're releasing Kibana 3.1.3 to correct them: https://www.elastic.co/downloads/past-releases/kibana-3-1-3...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user wit...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)

Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier fo...

Kibana 8.19.20, 9.3.5, 9.4.2 Security Update (ESA-2026-136)

Uncaught Exception in Kibana Cases Leading to Denial of Service Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for...

Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to ...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-116)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only read privileges on a single index can...

Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130 Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions fr...