Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
211 results · page 3 of 5
Apr 8, 2026Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122).CVE-2026-33460 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.CVE-2026-4819 · Other software · floragunn · reported by security@search-guard.comMedium 4.9
In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.
- Product
- Search Guard FLX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.search-guard.comsearch-guard.com
Mar 19, 2026Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive AllocationCVE-2026-26940 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolatioCVE-2026-26939 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary fCVE-2026-26938 · Other software · Elastic · reported by security@elastic.coHigh 8.6
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)CVE-2026-26937 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression ExponeCVE-2026-26936 · Other software · Elastic · reported by security@elastic.coMedium 4.9
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-15CVE-2026-26935 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of ServiCVE-2026-26934 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure throCVE-2026-0532 · Other software · Elastic · reported by security@elastic.coHigh 8.6
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors (Alerts & Connectors: All). The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coaccess.redhat.com
Jan 13, 2026Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted emCVE-2026-0543 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrievCVE-2026-0531 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request.CVE-2026-0530 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictCVE-2025-68422 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130)CVE-2025-68389 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in contCVE-2025-68387 · Other software · Elastic · reported by security@elastic.coMedium 6.1
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type toCVE-2025-68386 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in contenCVE-2025-68385 · Other software · Elastic · reported by security@elastic.coHigh 7.2
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s bCVE-2025-37732 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.CVE-2025-37734 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running asCVE-2025-37735 · Other software · Elastic · reported by security@elastic.coHigh 7
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)CVE-2025-25018 · Other software · Elastic · reported by security@elastic.coHigh 8.7
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)CVE-2025-25017 · Other software · Elastic · reported by security@elastic.coHigh 8.2
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2025Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked.CVE-2025-37728 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Insufficiently Protected Credentials in the Crowdstrike connector can lead to Crowdstrike credentials being leaked. A malicious user can access cached credentials from a Crowdstrike connector in another space by creating and running a Crowdstrike connector in a space to which they have access.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Oct 7, 2025Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.CVE-2025-25009 · Other software · Elastic · reported by security@elastic.coHigh 8.7
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana SCVE-2025-25010 · Other software · Elastic · reported by security@elastic.coMedium 6.5
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a speciallyCVE-2025-25012 · Other software · Elastic · reported by security@elastic.coMedium 4.3
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.CVE-2024-43706 · Other software · Elastic · reported by security@elastic.coHigh 7.6
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.CVE-2025-25014 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient sCVE-2025-25016 · Other software · Elastic · reported by security@elastic.coMedium 4.3
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScriCVE-2024-11390 · Other software · Elastic · reported by security@elastic.coMedium 5.4
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.CVE-2024-12556 · Other software · Elastic · reported by security@elastic.coHigh 8.7
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash.CVE-2024-52974 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.CVE-2025-25015 · Other software · Elastic · reported by security@elastic.coCritical 9.9
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI.CVE-2024-43708 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot.CVE-2024-52972 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints.CVE-2024-43710 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information.CVE-2024-43707 · Other software · Elastic · reported by security@elastic.coHigh 7.7
An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary.CVE-2024-52973 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37285 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37288 · Other software · Elastic · reported by security@elastic.coCritical 9.9
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024A flaw allowing arbitrary code execution was discovered in Kibana.CVE-2024-37287 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requestsCVE-2024-37281 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Jun 19, 2024A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.CVE-2024-23443 · Other software · Elastic · reported by security@elastic.coMedium 4.9
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Jun 14, 2024An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.CVE-2024-23442 · Other software · Elastic · reported by security@elastic.coMedium 6.1
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Jun 13, 2024A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting tCVE-2024-37279 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Feb 6, 2024An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when quCVE-2024-23446 · Other software · Elastic · reported by security@elastic.coMedium 6.5
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Dec 13, 2023An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level loggiCVE-2023-46675 · Other software · Elastic · reported by security@elastic.coHigh 8
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users, Elastic Security package policy objects which can contain private keys, bearer token, and sessions of 3rd-party integrations and finally Authorization headers, client secrets, local file paths, and stack traces. The issue may occur in any Kibana instance running an affected version that could potentially receive an unexpected error when communicating to Elasticsearch causing it to include sensitive data into Kibana error logs. It could also occur under specific circumstances when debug level logging is enabled in Kibana. Note: It was found that the fix for ESA-2023-25 in Kibana 8.11.1 for a similar issue was incomplete.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Dec 13, 2023An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error.CVE-2023-46671 · Other software · Elastic · reported by security@elastic.coHigh 8
An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibana_system user, API Keys, and credentials of Kibana end-users. The issue occurs infrequently, only if an error is returned from an Elasticsearch cluster, in cases where there is user interaction and an unhealthy cluster (for example, when returning circuit breaker or no shard exceptions).
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.codiscuss.elastic.co
Nov 21, 2023It was discovered that Kibana was not validating a user supplied path, which would load .pbf files.CVE-2021-22151 · Other software · Elastic · reported by security@elastic.coLow 3.1
It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.