Kibana vulnerabilities

Kibana has a resource allocation vulnerability (CWE-770) leading to denial of service via excessive allocation. A specially crafted request from an authenticated user with minimal privileges to a validation capability in the Observability log analysis feature causes unbounded concurrent work. This can exhaust memory and make Kibana unavailable until restart.

Kibana has an authorization bypass vulnerability through user-controlled key (CWE-639), allowing unauthorized query execution against Elastic Agents assigned to a space the user has no access to. A user authorized to run Osquery live queries in one space can have queries executed on hosts in another space, leading to information disclosure to the Osquery results data stream.

Missing Authorization in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts. A Kibana user who can author and evaluate Elastic Security detection rules can trigger response actions on enrolled agents without the required privileges.

Kibana has a missing authorization vulnerability (CWE-862) allowing unauthorized execution of Elastic Defend response actions on managed hosts. A user with only detection rule authoring privileges can associate automated endpoint response actions with a rule, even without dedicated endpoint privileges. When the rule generates alerts, the actions are executed on matching hosts.

Kibana has an inefficient algorithmic complexity vulnerability (CWE-407) leading to denial of service via input data manipulation. A specially crafted, deeply nested expression submitted to a TSVB visualization is evaluated with worst-case cost growing disproportionately with input size. Because evaluation runs synchronously, a single request consumes the request-processing thread indefinitely, and Kibana stops responding until restart.

Kibana has a missing authorization vulnerability (CWE-862) leading to information disclosure. An internal data retrieval capability used by Elastic Defend response actions did not enforce Security Solution and endpoint privileges, and retrieved data with elevated internal permissions. An authenticated low-privileged user with no Security Solution, endpoint, or Elasticsearch privileges could read endpoint response action records and response content from managed hosts.

An uncaught exception in Kibana, resulting from improper input validation, can lead to denial of service. An authenticated user with low privileges can submit specially crafted data that causes an internal error and terminates the Kibana process. Kibana becomes unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user with low privileges can submit a specially crafted malformed payload to a visualization feature, causing uncontrolled memory growth. The Kibana process is terminated once memory is exhausted, and the service becomes unavailable until restart.

Cross-Site Request Forgery in Kibana can lead to privilege escalation. A user allowed to create visualizations can save a crafted Vega visualization that, when opened by another user, triggers authenticated requests in the victim's session.

Improperly controlled modification of dynamically-determined object attributes in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data. An authenticated user without case editing privileges can alter case records they are only entitled to view, because the case management API does not enforce the same authorization as the user interface.

Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user authorized to manage maintenance windows can submit a specially crafted malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.

Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user with read-only privileges to the alerting feature can submit a specially crafted malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.

Authorization bypass through user-controlled key in Kibana can lead to information disclosure. An authenticated user authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

Kibana Agent Builder determines ownership of a private agent by comparing a stable user identifier when available, otherwise falling back to username comparison. Usernames are not unique across Elasticsearch authentication realms, so two distinct principals with the same username are treated as the same owner.

Authorization Bypass Through User-Controlled Key in Kibana allows unauthorized cross-space access. A user can access inference output from a trained model in another space without authorization, and can also stop or alter resources of an active model deployment.

An uncaught exception in Kibana Cases can lead to denial of service via input data manipulation. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user with privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

Allocation of resources without limits or throttling in Kibana can lead to denial of service via excessive allocation. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this input requires resource-intensive memory allocation that can exhaust available heap memory, causing the Kibana process to crash and become unavailable to all users.

An authorization bypass vulnerability in Kibana (CWE-639) allows attackers to use user-supplied identifiers to access scheduled query result data from Kibana Spaces they are not authorized to view.

An incorrect authorization vulnerability in Kibana's Machine Learning functionality allows low-privileged users to manipulate ML audit and notification records for arbitrary jobs across spaces using internally elevated credentials.

Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the required authorization through the documented API. The accessible data may include sensitive information returned by workflow steps, such as results from connected data sources that the caller would not otherwise be authorized to access.

Kibana has an incomplete list of disallowed inputs vulnerability (CWE-184). An authenticated attacker with access to the Reporting feature can bypass outbound request restrictions configured by an administrator.

Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

Vulnerability in Kibana (CWE-400) leading to denial of service via excessive allocation. An authenticated low-privileged user can send a crafted request to the Canvas functionality, causing the Kibana process to terminate.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana allows unauthorized information disclosure and compromise of case attachment integrity. A low-privileged authenticated user can read, modify, and delete case attachments they are not authorized to access, including those related to Security Solution.

Improper Access Control (CWE-284) in Kibana allows unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access can perform write operations on watchlist data that should require elevated privileges.

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

A vulnerability in Kibana allows an authenticated user to send a specially crafted request to Entity Analytics endpoints with an oversized input value, causing excessive resource consumption and making Kibana unavailable.

CWE-117 vulnerability in Kibana allows injection of unsanitized data into logs. An attacker can supply specially crafted input that is written to log files without proper neutralization. When logs are viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a low-privileged authenticated user can access response action data that they are not authorized to view.

CVE-2026-56151 in Kibana is an improper input validation vulnerability (CWE-20) that allows an authenticated user to submit a specially crafted Fleet policy input, causing a denial of service (DoS) via input data manipulation (CAPEC-153). This attack renders Fleet agent, server, and policy management functionality unavailable.

CVE-2026-49088 in Kibana allows insertion of sensitive information into log files. When optional APM instrumentation is enabled, sensitive request header values may be recorded in application logs.

CWE-770 vulnerability in Kibana allows a denial of service via excessive resource allocation. An authenticated attacker can send a crafted bulk deletion request, exhausting resources and making Kibana unavailable.

A vulnerability in the Kibana Fleet agent policy management feature allows privilege escalation. An authenticated user with Fleet management privileges can inject improperly validated values into a configuration override mechanism, causing Elastic Agents to be issued API keys with elevated Elasticsearch privileges.

CWE-400 vulnerability in Kibana allows a denial of service attack via excessive resource consumption. An authenticated user with viewer-level access can submit a request with an oversized input value to an analytics collections management endpoint. Kibana consumes excessive CPU and memory resources while processing the request, leading to service unavailability for all users until manual recovery.

A Server-Side Request Forgery (CWE-918) vulnerability in Kibana allows an authenticated user with connector management privileges to bypass the operator-configured connector allowlist. This can cause the Kibana server to issue outbound requests to destinations that egress controls were intended to block.

Kibana has an uncontrolled resource consumption vulnerability (CWE-400) leading to denial of service via excessive allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, backend services become unstable, causing service disruption and deployment unavailability for all users.

Kibana One Workflow has an SSRF vulnerability (CWE-918). An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

In Kibana, an Incorrect Authorization vulnerability (CWE-863) can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.

Incorrect authorization in Kibana allows a user with Fleet management privileges in one space to retrieve Fleet Server policy details from other spaces via an internal enrollment endpoint that bypasses space-scoped access controls.

Stored XSS vulnerability in Kibana. Improper input neutralization during page generation can lead to persistent XSS attacks.

Kibana contains an XSS vulnerability due to improper neutralization of input during web page generation.

Improper neutralization of input during web page generation in Kibana can lead to Stored XSS via case file upload.