Elastic Kibana

35 known vulnerabilities in Elastic Kibana, 1 critical, 1 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2019-7609 CVSS 10.0 critical · actively exploited Kibana Arbitrary Code Execution

Latest vulnerabilities

  • CVE-2026-94400 CVSS 6.5 medium Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
  • CVE-2026-78582 CVSS 6.5 medium Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control…
  • CVE-2026-72668 CVSS 7.3 high Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A…
  • CVE-2026-72662 CVSS 6.3 medium Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of…
  • CVE-2026-82302 CVSS 8.1 high Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured…
  • CVE-2026-82299 CVSS 6.5 medium Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control…
  • CVE-2026-82298 CVSS 4.3 medium Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security…
  • CVE-2026-78596 CVSS 4.3 medium Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to…
  • CVE-2026-78595 CVSS 4.3 medium Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead…
  • CVE-2026-78593 CVSS 4.3 medium An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management…
  • CVE-2026-78583 CVSS 8.1 high Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch…
  • CVE-2026-82293 CVSS 4.3 medium Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting…
  • CVE-2026-78601 CVSS 5.5 medium Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was…
  • CVE-2026-78599 CVSS 6.5 medium Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the…
  • CVE-2026-78598 CVSS 5.4 medium Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly…
  • CVE-2026-78591 CVSS 6.3 medium Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the…
  • CVE-2026-78590 CVSS 7.3 high Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the…
  • CVE-2026-78586 CVSS 6.5 medium Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation…
  • CVE-2026-78584 CVSS 4.3 medium Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for…
  • CVE-2026-78608 CVSS 6.5 medium Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was…
  • CVE-2026-78606 CVSS 4.2 medium Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing…
  • CVE-2026-78603 CVSS 4.3 medium Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security…
  • CVE-2026-78597 CVSS 4.3 medium Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing…
  • CVE-2026-78592 CVSS 7.3 high Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of…
  • CVE-2026-72682 CVSS 6.5 medium Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation…
  • CVE-2026-72654 CVSS 6.5 medium Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege…
  • CVE-2026-72652 CVSS 6.5 medium Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation…
  • CVE-2026-72644 CVSS 6.5 medium Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user…
  • CVE-2026-72641 CVSS 5.4 medium Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly…
  • CVE-2026-72633 CVSS 4.3 medium Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not…