Elastic Stack Security Announcements

Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents Affected Versions: All versions from 9.1.0 up to and including 9.4.4 Version 9.5.0 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 9.4.5 and 9.5.1. For Users that Cannot Upgrade: For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE ID: CVE-2026-72631 Problem Type: CWE-269 – Improper Privilege Management Impact: CAPEC-233 – Privilege Escalation 1 post – 1 participant Read full topic

Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed. Affected Versions: All versions from 9.4.0 up to and including 9.4.4 Version 9.5.0 Affected Configurations: All configurations that use multiple authentication realms where the user has control over their selected username. Solutions and Mitigations: The issue is resolved in Kibana versions 9.4.5 and 9.5.1. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE ID: CVE-2026-72643 Problem Type: CWE-863 – Incorrect Authorization 1 post – 1 participant Read full topic

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream. Affected Versions: All versions from 9.1.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.8 ) – CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVE ID: CVE-2026-72666 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana’s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller’s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts. Affected Versions: All versions from 9.1.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.7 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE ID: CVE-2026-72672 Problem Type: CWE-863 – Incorrect Authorization 1 post – 1 participant Read full topic

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user’s conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content. Affected Versions: All versions from 9.2.0 up to and including 9.4.4 Affected Configurations: Only conversations created through the agent-to-agent interface are affected, and the attacker must know or already share the identifier value used to create the target conversation Solutions and Mitigations: The issue is resolved in version 9.4.5. For Users that Cannot Upgrade: Disable Agent Builder globally by setting xpack.agentBuilder.enabled: false in kibana.yml and restarting Kibana. This fully removes exposure but also removes all Agent Builder functionality. Disable the Agent Builder feature in every Kibana space through Spaces management. This blocks the affected API as well as the user interface and does not require a restart, but must be applied to all spaces to be effective. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE ID: CVE-2026-72680 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature’s functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read. Affected Versions: All versions from 9.4.0 up to and including 9.4.3 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in version 9.4.4. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE ID: CVE-2026-72681 Problem Type: CWE-862 – Missing Authorization 1 post – 1 participant Read full topic

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance. Affected Versions: All versions from 9.3.0 up to and including 9.3.7 All versions from 9.4.0 up to and including 9.4.3 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 9.3.8 and 9.4.4. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-72674 Problem Type: CWE-770 – Allocation of Resources Without Limits or Throttling Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys Description: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana’s own internal Elasticsearch privileges rather than the caller’s. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests. Affected Versions: All versions from 8.19.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Version 9.5.0 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20, 9.4.5, and 9.5.1. Fleet no longer accepts caller-supplied filter expressions over fields that hold API key material, so the agent listing result count no longer reveals anything about those values. For Users that Cannot Upgrade: For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE ID: CVE-2026-72632 Problem Type: CWE-203 – Observable Discrepancy Impact: CAPEC-116 – Excavation 1 post – 1 participant Read full topic

Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation Description: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration’s configuration at the same time. Affected Versions: 8.x: All versions from 8.19.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Version 9.5.0 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20, 9.4.5, and 9.5.1. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE ID: CVE-2026-72630 Problem Type: CWE-863 – Incorrect Authorization Impact: CAPEC-122 – Privilege Abuse 1 post – 1 participant Read full topic

Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models Description: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of inference output from a trained model in a different space that the user is not authorized to list, read, or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and deployment update operations, allowing an active trained model deployment in another space to be stopped or to have its allocated resources altered. Affected Versions: All versions from 8.19.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Version 9.5.0 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20, 9.4.5 and 9.5.1. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVE ID: CVE-2026-72629 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user’s session. Affected Versions: All versions from 8.19.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: Self-Managed Disable the Vega visualization type by setting vis_type_vega.enabled: false in kibana.yml and restarting Kibana. Existing Vega visualizations and any dashboards that embed them will no longer render. Cloud Elastic Cloud Hosted deployments can apply the same setting through the Kibana user settings override in the Cloud Console, where that setting is permitted for the deployment version. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVE ID: CVE-2026-72658 Problem Type: CWE-352 – Cross-Site Request Forgery Impact: CAPEC-62 – Cross Site Request Forgery 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state. Affected Versions: All versions from 8.5.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: Deployments that use the Elastic Security solution together with Osquery Manager or Elastic Defend are affected. Exposure to host-side impact requires enrolled agents; without enrolled Osquery or Elastic Defend agents no response action can reach a host. Solutions and Mitigations: The issue is resolved in versions 8.19.20, and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 8.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE ID: CVE-2026-72665 Problem Type: CWE-862 – Missing Authorization Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the Elastic Security solution can associate automated endpoint response actions with a detection rule, even though the dedicated Endpoint response action privileges that govern those capabilities (host isolation, process operations, and execute operations) have not been granted to that user. When such a rule generates alerts, the associated response actions are carried out against the matching hosts. Affected Versions: All versions from 8.9.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: Deployments that use the Elastic Security solution with Elastic Defend agents enrolled. Solutions and Mitigations: The issue is resolved in versions 8.19.20, and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE ID: CVE-2026-72664 Problem Type: CWE-862 – Missing Authorization Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20, and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.1 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE ID: CVE-2026-72675 Problem Type: CWE-862 – Missing Authorization Impact: CAPEC-122 – Privilege Abuse 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user. Affected Versions: All versions up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: Kibana deployments running an affected version with the Machine Learning feature enabled Exploitation requires an authenticated Kibana user whose role grants the machine learning privileges to create anomaly detection jobs and data frame analytics jobs without granting the privilege to create trained models. The Machine Learning feature privileges available in the Kibana role management interface do not produce this combination, so exploitation depends on a custom role that assigns these privileges individually Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE ID: CVE-2026-72671 Problem Type: CWE-862 – Missing Authorization 1 post – 1 participant Read full topic

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view. Affected Versions: All versions up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: At least one Fleet proxy is configured with credentials Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.7 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE ID: CVE-2026-72670 Problem Type: CWE-200 – Exposure of Sensitive Information to an Unauthorized Actor 1 post – 1 participant Read full topic

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating User-Controlled Variables (CAPEC-77). Object attributes accepted by the case management API were not subject to the same authorization enforcement applied in the user interface, so a low-privileged user could alter case records they were only entitled to view. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20, 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE ID: CVE-2026-72655 Problem Type: CWE-915 – Improperly Controlled Modification of Dynamically-Determined Object Attributes Impact: CAPEC-77 – Manipulating User-Controlled Variables 1 post – 1 participant Read full topic

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20, 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-72651 Problem Type: CWE-770 – Allocation of Resources Without Limits or Throttling Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 4.3 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE ID: CVE-2026-72650 Problem Type: CWE-639 – Authorization Bypass Through User-Controlled Key Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service Description: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: Self-Managed Disable the TSVB visualization type by adding the following setting to kibana.yml and restarting Kibana: visTypeTimeseries.enabled: false Note that this removes the ability to create, edit, or render existing TSVB visualizations, including TSVB panels embedded in dashboards. Cloud For Elastic Cloud Hosted deployments, apply the same setting through the Kibana user settings override in the deployment edit view, then save to roll out the change. visTypeTimeseries.enabled: false Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. In Elastic Cloud Serverless the affected visualization type is read-only and cannot be created or edited. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-72663 Problem Type: CWE-407 – Inefficient Algorithmic Complexity Impact: CAPEC-153 – Input Data Manipulation 1 post – 1 participant Read full topic

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: Self-Managed Disable the Timelion visualization type by adding the following setting to kibana.yml and restarting Kibana: vis_type_timelion.enabled: false Note that this removes the ability to create, edit, or render existing Timelion visualizations. Cloud For Elastic Cloud Hosted deployments, apply the same setting through the Kibana user settings override in the deployment edit view, then save to roll out the change. vis_type_timelion.enabled: false Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. The affected visualization type is additionally not available in Elastic Cloud Serverless. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-72659 Problem Type: CWE-770 – Allocation of Resources Without Limits or Throttling Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is shared with. The safeguard that prevented the deletion of a private location still in use evaluated only the monitors visible in the requesting user’s own space, so monitors that depend on the private location in other spaces were not taken into account. As a result, an authenticated Kibana user holding the Synthetics write privilege in a single space could delete a private location that other spaces still depend on, even where the user has no access to those spaces. Deleting the private location removes the shared configuration and stops the monitors in the other spaces from running, which suppresses the availability monitoring those spaces rely on. Affected Versions: 8.x: All versions up to and including 8.19.19 9.x: All versions from 9.0.0 up to and including 9.4.3 Affected Configurations: Kibana deployments that use Synthetics with private locations shared across more than one space, and in which at least one user holds the Synthetics write privilege in only a subset of those spaces. Single-space deployments are not affected, because there is no cross-space boundary to bypass. Both self-managed and Elastic Cloud Hosted deployments are affected. No non-default configuration is required. Solutions and Mitigations: The issue is resolved in versions 8.19.20, and 9.4.4. For Users that Cannot Upgrade: Do not share a Synthetics private location across multiple spaces. A private location confined to a single space cannot be deleted by a user outside that space. Grant the Synthetics write privilege only to users who are trusted with every space that a shared private location is used in. Removing this privilege also removes the ability to create and edit private locations and monitors in that space. Indicators of Compromise (IOC) Review Kibana audit logs for deletions of Synthetics private locations carried out by accounts that do not administer all of the spaces the location was shared with. A private location that disappears while monitors in another space stop producing results, with no corresponding change request from the owners of that space, is consistent with exploitation. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 5.4 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE ID: CVE-2026-72673 Problem Type: CWE-863 – Incorrect Authorization Impact: CAPEC-1 – Accessing Functionality Not Properly Constrained by ACLs 1 post – 1 participant Read full topic

Uncaught Exception in Kibana Leading to Denial of Service Description: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly. Affected Versions: 8.x: All versions from 8.0.0 up to and including 8.19.19 9.x: All versions from 9.0.0 up to and including 9.3.7 All versions from 9.4.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. The vulnerability is present in the Kibana Security Solution feature set, which is enabled by default in self-managed and Elastic Cloud Hosted deployments. Exploitation requires an authenticated Kibana account with read access and the ability to write documents to at least one Elasticsearch index that Kibana subsequently reads. Solutions and Mitigations: The issue is resolved in versions 8.19.20, 9.3.8, 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-72660 Problem Type: CWE-248 – Uncaught Exception Impact: CAPEC-153 – Input Data Manipulation 1 post – 1 participant Read full topic

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat. Affected Versions: All versions from 8.0.0 up to and including 8.19.19 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.20 and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: Medium ( 6.5 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-72667 Problem Type: CWE-770 – Allocation of Resources Without Limits or Throttling Impact: CAPEC-130 – Excessive Allocation 1 post – 1 participant Read full topic

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner’s onboarding view to fail with a server error. Affected Versions: All versions from 8.9.0 up to and including 8.19.18 All versions from 9.0.0 up to and including 9.4.4 Affected Configurations: All configurations are affected. Solutions and Mitigations: The issue is resolved in versions 8.19.19 and 9.4.5. For Users that Cannot Upgrade: There are no workarounds for this vulnerability. Indicators of Compromise (IOC) No specific indicators of compromise have been identified for this vulnerability. Elastic Cloud Serverless Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. Severity: CVSSv3.1: High ( 7.6 ) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVE ID: CVE-2026-72669 Problem Type: CWE-862 – Missing Authorization 1 post – 1 participant Read full topic