Skip to content
OpenAdvisories
High WID-SEC-2026-2179 5 CVEs

Kibana: Mehrere Schwachstellen

Published Jul 1, 2026 · Updated Aug 13, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 5

  • High 8.0
    CVE-2026-49091

    Improper Output Neutralization for Logs in Kibana Leading to Log Injection

    Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-49087

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumptio…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-49089

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an ove…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-56151

    Improper Input Validation in Kibana Leading to Denial of Service

    Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server…

    Elastic Kibana
  • Medium 4.4
    CVE-2026-49088

    Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure

    Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application lo…

    Elastic Kibana

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-58244

  2. #1

    Initiale Fassung

References