Skip to content
OpenAdvisories
High WID-SEC-2026-0100 4 CVEs

Kibana: Mehrere Schwachstellen

Published Jan 13, 2026 · Updated Jan 14, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 4

  • High 8.6
    CVE-2026-0532

    External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector

    External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-0530

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform redundant processing operations that continuously consume syste…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-0531

    Allocation of Resources Without Limits or Throttling in Kibana Fleet

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, w…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-0543

    Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation

    Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privi…

    Elastic Kibana

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-2517

  2. #1

    Initiale Fassung

References