Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-135)

Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)

Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-115)

Uncaught Exception in Kibana Leading to Denial of Service Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-114)

Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause...

Kibana 9.4.3 Security Update (ESA-2026-61)

Incorrect Authorization in Kibana Leading to Privilege Escalation Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. A user holding workflow edit permissions could cause scheduled workflow...

Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that...

Elasticsearch 8.19.20, 9.3.0 Security Update (ESA-2026-47)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a special...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-168)

Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the...

Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-160)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path...

Kibana 8.19.21, 9.4.6 Security Update (ESA-2026-155)

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding minimal...

Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana us...

Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only...

Kibana 9.4.6 Security Update (ESA-2026-84)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder...

Kibana 8.19.17, 9.3.0 Security Update (ESA-2026-31)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that...

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. ...

Kibana 9.4.5 Security Update (ESA-2026-97)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting...

Kibana 9.4.5 Security Update (ESA-2026-89)

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead o...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

Kibana 9.4.4 Security Update (ESA-2026-83)

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by t...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-129)

Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys Description: Observable Discrepancy CWE-203 in Kibana Fleet can lead to information disclosure via Excavation CAPEC-116. Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-127)

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation Description: Incorrect Authorization CWE-863 in Kibana Fleet can lead to privilege escalation via Privilege Abuse CAPEC-122. Fleet restricts some callers to managing integration policies for one specific integration. When an...

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when i...

Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-96)

Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-...

Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)

Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...

Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization CWE-862 in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse CAPEC-122...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-106)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user with read-only privileges to the alerting...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-105)

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-104)

Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service Description: Inefficient Algorithmic Complexity CWE-407 in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization i...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-100)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A specially crafted, malformed payload submitted to a...

Kibana 8.19.20, and 9.4.4 Security Update (ESA-2026-90)

Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1...

Kibana 8.19.20, 9.3.8, and 9.4.5 Security Update (ESA-2026-101)

Uncaught Exception in Kibana Leading to Denial of Service Description: Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged access can cause an...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user wit...

Kibana 8.19.19 and 9.4.5 Security Update (ESA-2026-86)

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user who is authorized to manage maintenance window...

Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)

Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal Kibana data retrieval capability used by Elastic Defend...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)

Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier fo...

Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)

Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifa...

Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-76)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges ca...