Skip to content
Threat Feed
Subscribe

Tag

Kibana

4 briefs RSS
medium advisory

Multiple Vulnerabilities in Elastic Products

CERT-FR has issued an advisory detailing multiple vulnerabilities in Elastic products, including CVE-2026-42397 and CVE-2026-49092, which could allow an attacker to cause remote denial of service, compromise data confidentiality and integrity, and perform Server-Side Request Forgery (SSRF).

Elasticsearch 8.x +5 vulnerability elastic elasticsearch kibana data-integrity data-confidentiality denial-of-service ssrf
5c
high advisory

Multiple Vulnerabilities in Elastic Kibana

Multiple vulnerabilities in Elastic Kibana allow for privilege escalation, remote denial of service, data breach, server-side request forgery (SSRF), and cross-site scripting (XSS).

Kibana +2 vulnerability privilege escalation denial of service data breach SSRF XSS
2r 3t 5c
medium advisory

Kibana Fleet Plugin Privilege Escalation via CVE-2026-4498

CVE-2026-4498 allows an authenticated Kibana user with Fleet sub-feature privileges to read index data beyond their direct Elasticsearch RBAC scope due to improper privilege handling in debug route handlers.

cve privilege-escalation kibana
2r 1t 1c
high advisory

Kibana Fleet API Authorization Bypass (CVE-2026-33461)

Kibana is vulnerable to an authorization bypass (CVE-2026-33461) where users with limited Fleet privileges can access sensitive configuration data, including private keys and authentication tokens, via an internal API endpoint.

Kibana authorization-bypass privilege-escalation
2r 2t 1c