Filtered by vendor Elastic
Subscribe
Total
370 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-33466 | 1 Elastic | 1 Logstash | 2026-07-24 | N/A | 8.1 HIGH |
| Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction utilities used by Logstash do not properly validate file paths within compressed archives. An attacker who can serve a specially crafted archive to Logstash through a compromised or attacker-controlled update endpoint can write arbitrary files to the host filesystem with the privileges of the Logstash process. In certain configurations where automatic pipeline reloading is enabled, this can be escalated to remote code execution. | |||||
| CVE-2026-33458 | 1 Elastic | 1 Kibana | 2026-07-24 | N/A | 6.3 MEDIUM |
| Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data. | |||||
| CVE-2026-33467 | 1 Elastic | 1 Elastic Package Registry | 2026-07-24 | N/A | 5.9 MEDIUM |
| Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed. | |||||
| CVE-2026-33459 | 1 Elastic | 1 Kibana | 2026-07-24 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users. | |||||
| CVE-2026-33461 | 1 Elastic | 1 Kibana | 2026-07-24 | N/A | 7.7 HIGH |
| Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs. | |||||
| CVE-2026-49093 | 1 Elastic | 1 Kibana | 2026-07-21 | N/A | 6.3 MEDIUM |
| Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block. | |||||
| CVE-2026-49094 | 1 Elastic | 1 Kibana | 2026-07-21 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered. | |||||
| CVE-2026-49095 | 1 Elastic | 1 Kibana | 2026-07-21 | N/A | 6.5 MEDIUM |
| Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch security indices beyond what is intended for the Fleet management role. | |||||
| CVE-2026-26940 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allows an authenticated user to send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value. | |||||
| CVE-2026-26939 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges. | |||||
| CVE-2026-26938 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 8.6 HIGH |
| Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Injection (CAPEC-242). This requires an authenticated user who has the workflowsManagement:executeWorkflow privilege. | |||||
| CVE-2026-26937 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) | |||||
| CVE-2026-26936 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 4.9 MEDIUM |
| Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). | |||||
| CVE-2026-26935 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) | |||||
| CVE-2026-26934 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing. | |||||
| CVE-2026-0543 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed. | |||||
| CVE-2026-0531 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users. | |||||
| CVE-2026-0530 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume system resources until service degradation or complete unavailability occurs. | |||||
| CVE-2026-0528 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data. | |||||
| CVE-2025-68422 | 1 Elastic | 1 Kibana | 2026-06-17 | N/A | 4.3 MEDIUM |
| Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This allows an attacker who lacks the live queries - read permission to successfully retrieve the list of live queries. | |||||