Elastic Stack Security Announcements

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index’s document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index. Affected Versions: 8.x: All versions from 8.13.0 up to and including 8.19.22 9.x: All versions from 9.0.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 Affected Configurations: This issue only affects clusters configured as a fulfilling cluster for cross-cluster search using the Remote Cluster Security (RCS) 2.0 model. Deployments that do not expose a remote cluster transport port for cross-cluster search are not affected. This issue is not exploitable via the REST API. Solutions and Mitigations: The issue is resolved in versions 8.19.23, 9.4.8, and 9.5.5. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: If cross-cluster search using RCS 2.0 is not required, disable remote cluster connections on the fulfilling cluster to remove exposure to this issue. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless This vulnerability does not apply to Elastic Cloud Serverless. Severity: CVSSv3.1: High ( 7.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE ID: CVE-2026-103009 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key 1 post – 1 participant Read full topic

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script’s output is not bounded. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure. Processing this request recurses past the available stack space, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention to restore service. Affected Versions: 8.x: All versions from 8.12.0 up to and including 8.19.22 9.x: All versions from 9.0.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.23, 9.4.8, and 9.5.5. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-103008 Problem Type: CWE-674 – Uncontrolled Recursion 1 post – 1 participant Read full topic

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster. Affected Versions: 8.x: All versions from 8.16.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: This issue only affects deployments that use the configurable delegated role-management privilege (“manage_roles”) where the index names in that privilege include wildcard or regular-expression patterns that can match restricted or system indices (for example *, *kibana*, or /.*/). Deployments that do not use this feature, or that scope such delegations only to literal index names, are not affected. This feature is not available on Elastic Cloud Serverless. Solutions and Mitigations: The issue is resolved in versions 8.19.22, 9.4.7, and 9.5.4. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: Self-hosted and Elastic Cloud Hosted: Review any roles that grant the delegated role-management privilege and ensure their configured index names do not use wildcard or regular-expression patterns that could match system or restricted indices. Restrict such grants to literal index names, or remove the privilege from roles assigned to users who should not be able to expand their own access. Audit existing roles created through this feature for unexpected access to restricted or internal indices. Indicators of Compromise (IOC) Review security audit logs for role or user modifications performed by accounts holding the delegated role-management privilege, particularly where the resulting role or user was subsequently used to access restricted system indices or was granted elevated (e.g. superuser-equivalent) privileges. Elastic Cloud Serverless This vulnerability does not apply to Elastic Cloud Serverless, where the affected feature is not available. Severity: CVSSv3.1: High ( 7.2 ) – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-103007 Problem Type: CWE-863 – Incorrect Authorization 1 post – 1 participant Read full topic

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process’s available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.20 9.x: All versions from 9.0.0 up to and including 9.4.5 All versions from 9.5.0 up to and including 9.5.1 Affected Configurations: All configurations are affected. The vulnerable code path is part of Elasticsearch’s search aggregation functionality, which is enabled by default. Solutions and Mitigations: The issue is resolved in versions 8.19.21, 9.4.6, and 9.5.2. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-103006 Problem Type: CWE-674 – Uncontrolled Recursion 1 post – 1 participant Read full topic

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large description field are created and subsequently accessed, exhausting available heap memory and crashing the affected node. Affected Versions: 8.x: All versions from 8.12.0 up to and including 8.19.22 9.x: All versions from 9.0.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 No fix is available for the 9.3.x line. Users on this line should upgrade to one of the fixed versions listed in Solutions and Mitigations, or a later release containing the fix. Elasticsearch versions prior to 8.12.0 are not affected, as the Connector API did not exist in those releases. Affected Configurations: Configurations that expose the Connector API to users holding connector management privileges are affected. This includes both self-managed Elasticsearch clusters and Elastic Cloud Hosted deployments where the connector feature is used. Solutions and Mitigations: The issue is resolved in versions 8.19.23, 9.4.8, and 9.5.5. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-103005 Problem Type: CWE-789 – Memory Allocation with Excessive Size Value Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend’s Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, which can degrade or disable Elastic Defend’s real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists. Affected Versions: 8.x: All versions from 8.19.13 up to and including 8.19.21 9.x: All versions from 9.2.7 up to and including 9.2.8 All versions from 9.3.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 Elastic Agent / Endpoint versions prior to 8.19.13 on the 8.19.x line, and prior to 9.2.7 on the 9.2.x line, are not affected by this issue. No fix is available for the 9.2.x or 9.3.x lines; users on these lines should upgrade to a supported release line. Affected Configurations: Hosts running with certain Windows system locales (including Chinese, Japanese, and Korean) are affected; hosts running other locales are not affected. Solutions and Mitigations: This issue is resolved in Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Severity: CVSSv3.1: Medium ( 6.2 ) – CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-102413 Problem Type: CWE-248 – Uncaught Exception 1 post – 1 participant Read full topic

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker to obtain private cryptographic key material configured for Fleet Server host connections, potentially enabling impersonation of trusted Fleet infrastructure components in deployments where those keys are actively used. Affected Versions: 9.x: All versions from 9.3.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 No fix is available for the 9.3.x line, which is no longer maintained. Users on 9.3.x should upgrade to a supported release line. Users on the 8.x release line are not affected. The Fleet Server host SSL private key functionality that contains this vulnerability was introduced after the 8.x release line and is not present in 8.19.x. Affected Configurations: Kibana deployments using Fleet where Fleet Server hosts are configured with SSL/TLS private key material stored in Fleet settings. Deployments that do not configure Fleet Server hosts with private key material in Fleet settings are not exposed to this vulnerability. Solutions and Mitigations: The issue is resolved in Kibana 9.4.8 and 9.5.5. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: Self-hosted and Cloud: Administrators can mitigate this vulnerability by removing the Fleet agent management feature privilege from any Kibana role assigned to users who should not have access to Fleet Server host configuration data. Users who require Fleet agent operations but not Fleet settings visibility should not be granted the Fleet agents_all Kibana feature privilege unless they also hold Fleet settings read access. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE ID: CVE-2026-102412 Problem Type: CWE-863 – Incorrect Authorization Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the manage_index_templates cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.22 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.2 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in Elasticsearch 9.4.7, 9.5.3, and 8.19.23. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-102411 Problem Type: CWE-770 – Allocation of Resources Without Limits or Throttling 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an index, but no corresponding Kibana feature privilege, could retrieve index-derived metric data through Kibana that the properly-authorized API would otherwise have blocked. Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.3.8 Users on the 8.x release line are not affected. The Metrics Experience functionality that contains this vulnerability was introduced in version 9.2.0 and is not present in earlier releases. Users on the 9.4.x and later release lines are not affected because the affected functionality was removed entirely from Kibana in version 9.4.0. Affected Configurations: All configurations running an affected version with the Metrics Experience feature present are affected. Exposure requires that a user already hold read access to a data index at the underlying data-store layer, independent of their Kibana feature privileges. Solutions and Mitigations: This vulnerability is resolved by upgrading to version 9.4.0 or later, in which the affected Metrics Experience functionality was removed entirely. There is no patched release within the 9.2.x or 9.3.x lines; those lines are no longer receiving new releases, so affected customers must upgrade to a currently maintained release line. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE ID: CVE-2026-102410 Problem Type: CWE-862 – Missing Authorization 1 post – 1 participant Read full topic

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130). Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.2.8 All versions from 9.3.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 No fix is available for the 9.2.x or 9.3.x release lines. Users should upgrade to a supported release line. Users on the 8.x release line are not affected. The text chunking functionality that contains this vulnerability was introduced in a 9.x release and is not present in 8.x. Users on the 9.0.x and 9.1.x release lines are not affected. The text chunking functionality that contains this vulnerability was introduced in 9.2.0 and is not present in these release lines. Affected Configurations: Elasticsearch deployments where ES|QL is enabled (enabled by default) and where authenticated users with low-privileged index read access can submit queries. Solutions and Mitigations: The issue is resolved in versions 9.4.8 and 9.5.5. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-102409 Problem Type: CWE-674 – Uncontrolled Recursion 1 post – 1 participant Read full topic

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function’s recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue. Affected Versions: 8.x: All versions from 8.19.0 up to and including 8.19.21 9.x: All versions from 9.1.0 up to and including 9.3.8 All versions from 9.4.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 Users on the 8.0.x–8.18.x and 9.0.x release lines are not affected. The chunking functionality that contains this vulnerability was not introduced until 8.19.0 and 9.1.0 respectively. No fix is available for the 9.1.x, 9.2.x, or 9.3.x lines; users on these lines should upgrade to a supported release line. Affected Configurations: Deployments where an authenticated user is permitted to issue ES|QL queries using the CHUNK function’s recursive chunking strategy with caller-supplied separators are affected. This applies regardless of whether an admin role is held; the built-in “viewer” role and any custom role with read access to a text-family index are sufficient. Solutions and Mitigations: This issue is resolved in Elasticsearch 8.19.22, 9.4.8, and 9.5.5. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE ID: CVE-2026-102408 Problem Type: CWE-1333 – Inefficient Regular Expression Complexity Impact: CAPEC-492 – Regular Expression Exponential Blowup 1 post – 1 participant Read full topic

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to. Affected Versions: 7.x: All versions from 7.17.5 up to and including 7.17.29 No fix is available for the 7.17.x line. Users should upgrade to a supported release line. 8.x: All versions from 8.2.2 up to and including 8.19.18 9.x: All versions from 9.0.0 up to and including 9.3.7 All versions from 9.4.0 up to and including 9.4.3 Affected Configurations: All configurations that use Elasticsearch Security (role-based access control) together with data streams are affected. No non-default configuration is required to trigger this issue. Solutions and Mitigations: The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 5.4 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE ID: CVE-2026-102407 Problem Type: CWE-863 – Incorrect Authorization Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, “tenant” refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana’s Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch administrative privileges, to claim a data stream identifier already in use by another tenant. Because ownership of that identifier was not verified before Fleet applied the uploaded package’s generated index and ingest-pipeline settings to already-existing infrastructure, an attacker could redirect an existing tenant’s data stream through infrastructure under their control. This exposed the affected tenant’s subsequently ingested data to unauthorized disclosure and modification, and prevented that data from reaching its intended destination. Interception could continue even after the malicious package was removed, requiring separate remediation of the affected infrastructure. Affected Versions: 8.x: All versions from 8.14.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: Kibana deployments with Fleet enabled where a user without full superuser access has been granted the Fleet feature privileges required to install custom (uploaded) integration packages. Both self-managed and Elastic Cloud Hosted deployments are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.22, 9.4.7, and 9.5.4. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: Self-hosted Until upgrading, remove the Fleet feature privileges required to install custom integration packages from any role held by a user who should not be trusted to manage other tenants’ data, restricting custom package uploads to full superusers only. Cloud The same privilege restriction can be applied on Elastic Cloud Hosted through Kibana role management; no additional cloud-specific limitation is required. Indicators of Compromise (IOC) Review the installation history of uploaded (non-registry) Fleet packages for any package that declares a dataset already used by a data stream you did not create, and check whether the ingest pipeline governing an existing data stream’s backing indices changed as a result of a package installation you did not expect. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 8.8 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2026-102406 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.22 9.x: All versions from 9.0.0 up to and including 9.4.7 All versions from 9.5.0 up to and including 9.5.4 Users on the 9.6.x release line are not affected. The vulnerability was fixed before the first release of the 9.6.x line. Affected Configurations: All deployments where authenticated users can execute ES|QL queries. No special configuration is required beyond the default; the vulnerable behavior is present in all standard configurations. Solutions and Mitigations: The issue is resolved in versions 8.19.23, 9.4.8, 9.5.5. The versions above are the first releases that contain the fix, and later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-102404 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.2 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.3. The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.9 ) – CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-94408 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.4. The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-94397 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 9.x: All versions from 9.2.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 9.4.7, 9.5.4. The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-94396 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Kibana Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.2 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.3. The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-94400 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.4. The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-94399 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: All versions from 8.12.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: All configurations Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.4. The versions above are the first releases that contain the fix where later releases also contain it. Elastic recommends upgrading to the most recent release available, and reviewing the known issues for your target version before upgrading. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-94398 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.3 Affected Configurations: All configurations where authenticated users have privileges to invoke index analysis APIs. Solutions and Mitigations: The issue is resolved in version 8.19.22, 9.4.7, 9.5.4. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-82300 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation Revision History 2026-09-28: Previously the affected versions included 9.4.7. This was a typo, the affected range is 9.0.0 up to and including 9.4.6 1 post – 1 participant Read full topic

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.20 9.x: All versions from 9.0.0 up to and including 9.4.5 All versions from 9.5.0 up to and including 9.5.2 Affected Configurations: All configurations with analytical aggregation search capabilities enabled. Solutions and Mitigations: The issue is resolved in versions 8.19.21, 9.4.6, 9.5.3. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-82294 Problem Type: CWE-400 – Uncontrolled Resource Consumption Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply. Affected Versions: 7.x: All versions 7.12.0 up to and including 7.17.29 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.0.0 up to and including 9.4.6 All versions from 9.5.0 up to and including 9.5.2 Affected Configurations: Deployments where Kibana spaces are in use and Synthetics monitors are shared across more than one space. Deployments where monitors are not shared across spaces are not exposed to this vulnerability. Solutions and Mitigations: The issue is resolved in Kibana version 8.19.22, 9.4.7, 9.5.3. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE ID: CVE-2026-78582 Problem Type: CWE-862 – Missing Authorization Impact: CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels 1 post – 1 participant Read full topic

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.21 9.x: All versions from 9.4.0 up to and including 9.4.5 Affected Configurations: Kibana deployments that use the Security Solution Timeline feature. Solutions and Mitigations: The issue is resolved in Kibana version 8.19.22, 9.4.6. For Users that Cannot Upgrade: There are no workarounds Indicators of Compromise (IOC) A draft Timeline object whose creating user and last-updating user are distinct accounts indicates that a user other than the owner changed the object. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE ID: CVE-2026-72662 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Unintended Proxy or Intermediary (‘Confused Deputy’) in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary (‘Confused Deputy’) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster. Affected Versions: 9.x: All versions from 9.4.0 up to and including 9.4.6 Users on the 8.x release line and on 9.3.x and earlier are not affected. The combination of Agent Builder and Workflows functionality that contains this vulnerability was introduced in Kibana 9.4.0. Affected Configurations: Kibana deployments running an affected version with the Agent Builder and Workflows features enabled; both are enabled by default A generative AI connector is configured for Agent Builder Exploitation requires a non-administrative authenticated user holding the Agent Builder privilege to manage agents together with the Workflows privilege to create workflows, and no Elasticsearch cluster privileges Exploitation also requires that a higher-privileged user subsequently interacts with the affected agent Solutions and Mitigations: The issue is resolved in Kibana version 9.4.7, 9.5.0. For Users that Cannot Upgrade: Disable the Workflows feature in Kibana. This removes all Workflows functionality. Review the workflows attached to existing agents, including the default assistant, and remove any that were not configured by an administrator. Indicators of Compromise (IOC) Kibana audit log entries recording changes to Agent Builder agent configurations by users who are not administrators, and the creation or modification of Elasticsearch users, roles, or API keys coinciding with Agent Builder activity by a privileged user, may indicate exploitation of this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVE ID: CVE-2026-72668 Problem Type: CWE-441 – Unintended Proxy or Intermediary (‘Confused Deputy’) Impact: CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels 1 post – 1 participant Read full topic