Skip to content
OpenAdvisories
High WID-SEC-2026-0545 5 CVEs

Kibana: Mehrere Schwachstellen ermöglichen Denial of Service und Offenlegung von Informationen

Published Feb 26, 2026 · Updated Feb 26, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 5

  • High 8.6
    CVE-2026-26938

    Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)

    Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Inj…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-26934

    Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service

    Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed pay…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-26935

    Improper Input Validation in Kibana Leading to Denial of Service

    Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

    Elastic Kibana
  • Medium 6.5
    CVE-2026-26937

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

    Elastic Kibana
  • Medium 4.9
    CVE-2026-26936

    Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service

    Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References