CVE-2026-72666

Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.

Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.

Incorrect authorization in Kibana can lead to disclosure of sensitive information. An authenticated user with limited Fleet privileges could access credential material restricted to Fleet administrators. Exploitation may allow theft of cryptographic keys and impersonation of trusted Fleet infrastructure components.

Missing authorization in Kibana's Metrics Experience feature allows a user with only data-store-level read access to retrieve index-derived metric data through Kibana, despite lacking the corresponding Kibana feature privilege. A related API enforced authorization, but this internal API did not.

Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.

Uncontrolled resource consumption (CWE-400) in Kibana can lead to denial of service via excessive allocation (CAPEC-130).

Missing authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via exploiting incorrectly configured access control security levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

A vulnerability in Kibana allows authorization bypass through a user-controlled key (CWE-639). An authenticated user with the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.