By vendor

Elastic vulnerabilities

Known CVEs affecting Elastic products, prioritized by severity, with SEC.co remediation and detection guidance.

19 published vulnerabilities

• CVE-2026-49091HIGH 8.0

  Kibana contains a flaw where specially crafted input can be injected into log files without being properly cleaned or neutralized. When those logs are later displayed in a terminal, the injected content may include control sequences that alter what the user sees—potentially masking real activity, inserting false entries, or manipulating audit trails. An attacker must have valid credentials to exploit this, and the victim must view the compromised logs in an affected terminal. This creates a risk to log integrity and could complicate incident investigation or compliance audits.

• CVE-2026-42398HIGH 7.7

  CVE-2026-42398 is a Server-Side Request Forgery (SSRF) vulnerability in Kibana that allows authenticated users with connector management privileges to circumvent network egress restrictions. An attacker with the right permissions can configure a malicious Webhook connector that tricks Kibana into making outbound HTTP requests to internal or restricted destinations that should have been blocked by the organization's firewall or allowlist policies. This effectively punches through network security controls by leveraging Kibana's own trusted outbound connection capability.

• CVE-2026-33464MEDIUM 6.5

  Kibana contains a denial-of-service vulnerability that allows low-privileged authenticated users to crash the service by sending an oversized request to an internal API. When exploited, Kibana becomes unresponsive to all users until manually restarted or the process recovers. This is a resource exhaustion attack that requires valid credentials but no special privileges.

• CVE-2026-42399MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic access to crash the application by uploading specially crafted visualizations. An attacker submits a Timelion visualization with deeply nested function calls that causes Kibana to allocate memory without limit, eventually consuming all available RAM and taking the service offline for everyone. This is a denial-of-service attack that requires valid credentials but no administrative privileges.

• CVE-2026-42400MEDIUM 6.5

  CVE-2026-42400 is a denial-of-service vulnerability in Kibana that allows an authenticated user to crash or freeze a Kibana instance by sending a malicious compressed request. The vulnerability exists because Kibana processes and decompresses incoming requests before fully validating user permissions, meaning an attacker can consume excessive memory and CPU resources on the server before authorization checks can stop them. While this requires valid credentials to exploit, the impact is straightforward: a Kibana instance can become unresponsive or crash entirely, disrupting visibility and analysis capabilities that teams depend on.

• CVE-2026-49087MEDIUM 6.5

  CVE-2026-49087 is a denial-of-service vulnerability in Kibana that allows an authenticated user to crash or freeze the service by submitting a specially crafted bulk deletion request. The attack exploits a lack of resource limits in Kibana's request handling, causing it to consume excessive memory or CPU until it becomes unresponsive. Because the attacker must already have valid credentials, the risk is primarily to organizations where insider threats or credential compromise are concerns.

• CVE-2026-49090MEDIUM 6.5

  An authenticated user in Elasticsearch can submit a specially crafted bulk request that causes a denial of service by forcing sustained high CPU consumption on the affected node. The node becomes unable to process legitimate requests, effectively taking it offline without requiring any special access privileges or user interaction. While this requires valid credentials to execute, it can disrupt availability across your infrastructure.

• CVE-2026-49094MEDIUM 6.5

  A vulnerability in Kibana allows authenticated users with basic viewer access to cause the service to become unavailable by submitting specially crafted requests to analytics collection endpoints. When Kibana processes these requests, it exhausts system CPU and memory resources, forcing administrators to manually restart the service to restore availability. The attacker does not need elevated permissions—standard viewer-level credentials are sufficient to trigger the denial of service.

• CVE-2026-49095MEDIUM 6.5

  CVE-2026-49095 is a privilege escalation vulnerability in Elastic Kibana's Fleet agent policy management. An authenticated user with Fleet management permissions can manipulate how agent policies are configured in a way that bypasses input validation. This manipulation tricks Elastic Agents into receiving API keys with permissions beyond what they should have, potentially allowing unauthorized access to Elasticsearch security indices. The vulnerability requires an authenticated attacker with existing Fleet management privileges, limiting the immediate blast radius but posing a significant insider risk to organizations managing large agent fleets.

• CVE-2026-56148MEDIUM 6.5

  CVE-2026-56148 is a denial-of-service vulnerability in Elasticsearch that allows authenticated users to crash or disable individual cluster nodes by sending specially crafted queries. The flaw stems from uncontrolled recursion in query processing, which causes the server to consume excessive memory and CPU resources until it becomes unresponsive. An attacker must have valid credentials to exploit this, but once authenticated, no special permissions or user interaction is required—the malicious query does its damage simply by being processed.

• CVE-2026-56150MEDIUM 6.5

  Fleet Server, Elastic's agent management platform, contains a vulnerability in its file upload functionality that allows authenticated attackers to cause denial of service by submitting requests designed to consume excessive memory. An attacker with valid credentials can trigger uncontrolled resource allocation, potentially rendering the server unresponsive or forcing a restart. The vulnerability stems from missing limits or throttling mechanisms on resource consumption during upload operations.

• CVE-2026-56151MEDIUM 6.5

  A flaw in Kibana's Fleet policy input validation allows authenticated users to submit specially crafted data that crashes or disables Fleet functionality. An attacker with valid credentials can manipulate policy inputs to knock out agent communications, server operations, and policy management until administrators restart services or clear the offending configuration. This is a denial-of-service attack requiring legitimate access, so the blast radius is limited to environments where insider threats or compromised accounts are a concern.

• CVE-2026-49093MEDIUM 6.3

  CVE-2026-49093 is a Server-Side Request Forgery (SSRF) vulnerability in Kibana that allows authenticated users with connector management privileges to circumvent network egress controls. An attacker with these privileges can craft malicious connector configurations that cause the Kibana server to make outbound requests to internal or otherwise-blocked destinations, defeating the intent of operator-configured allowlists. This requires authentication and specific administrative permissions, but poses a meaningful risk to organizations using Kibana connectors for alerting, webhooks, or integrations.

• CVE-2026-33463MEDIUM 5.3

  Kibana contains a flaw where access tokens that should expire at a specific time continue to work indefinitely. An attacker who obtains one of these tokens—even after it should have stopped being valid—can use it to read sensitive information they shouldn't have access to. The vulnerability stems from improper validation of token expiration times, allowing the system to forget when a token was supposed to stop working.

• CVE-2026-56152MEDIUM 5.3

  Elastic Defend contains an authorization flaw that allows low-privileged authenticated users to view response action data they should not have access to. The vulnerability exploits a gap in access control enforcement, enabling information disclosure under specific conditions. An attacker would need valid credentials and network access to the affected system, but the barrier to exploitation is moderately high due to the required conditions.

• CVE-2026-56149MEDIUM 4.9

  A vulnerability in Elasticsearch allows users with administrative or elevated privileges to crash an Elasticsearch node by submitting a malicious machine learning request. The attack causes the affected node to consume excessive memory until it becomes unavailable, effectively denying service to legitimate users. This is a resource exhaustion issue that requires elevated permissions to exploit, limiting its immediate blast radius but still posing operational risk in multi-tenant or shared Elasticsearch environments.

• CVE-2026-33462MEDIUM 4.6

  A path traversal flaw in Kibana's dashboard management allows an authenticated user with basic permissions to craft a malicious dashboard identifier. When an administrator deletes this dashboard, the deletion request bypasses security controls and targets unintended internal endpoints—potentially destroying user accounts or other critical resources. The vulnerability requires an administrator to take action on the malicious object, making it a privilege-escalation path rather than a self-executing exploit.

• CVE-2026-49088MEDIUM 4.4

  Kibana's optional application performance monitoring (APM) feature can inadvertently record sensitive HTTP request headers in application logs. If an operator with log file access gains visibility into these logs, they may be exposed to sensitive information such as authentication tokens or API keys that were passed in request headers. This is a logging misconfiguration issue rather than a direct attack vector—the vulnerability requires both APM instrumentation to be enabled and an insider or log-access breach to be exploited.

• CVE-2026-42401MEDIUM 4.1

  CVE-2026-42401 is a stored HTML injection vulnerability in Kibana that allows an attacker with write access to an Elasticsearch index to inject malicious markup. When other users view the affected Kibana dashboard or visualization, the injected code is not properly sanitized before rendering in their browser. This can enable unauthorized UI changes and cause the victim's browser to make unintended outbound network requests on their behalf.