Skip to content
OpenAdvisories
Medium WID-SEC-2026-1734 10 CVEs

Kibana: Mehrere Schwachstellen

Published May 28, 2026 · Updated May 28, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 10

  • High 7.7
    CVE-2026-42398

    Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

    Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to i…

    Elastic Kibana
  • High 7.2
    CVE-2026-49095

    Improper Input Validation in Kibana Fleet Leading to Privilege Escalation

    Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration …

    Elastic Kibana
  • Medium 6.5
    CVE-2026-33464

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causin…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-42399

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially cra…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-42400

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing ex…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-49094

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections manag…

    Elastic Kibana
  • Medium 6.3
    CVE-2026-49093

    Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access

    Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress control…

    Elastic Kibana
  • Medium 5.3
    CVE-2026-33463

    Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access

    Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended val…

    Elastic Kibana
  • Medium 4.6
    CVE-2026-33462

    Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts

    A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete th…

    Elastic Kibana
  • Medium 4.1
    CVE-2026-42401

    Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection

    Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view…

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References