Skip to content
OpenAdvisories
Medium WID-SEC-2026-2464 13 CVEs

Kibana: Mehrere Schwachstellen

Published Jul 21, 2026 · Updated Jul 21, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder Daten offenzulegen und zu manipulieren.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 13

  • High 7.1
    CVE-2026-56147

    Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana's file access authorization logic allows …

    Elastic Kibana
  • Medium 6.5
    CVE-2026-42397

    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an ov…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-63139

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by s…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-63260

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, o…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-63261

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exha…

    Elastic Kibana
  • Medium 6.3
    CVE-2026-63141

    Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

    Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.

    Elastic Kibana
  • Medium 5.4
    CVE-2026-56146

    Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure

    Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write…

    Elastic Kibana
  • Medium 5.0
    CVE-2026-63142

    Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

    Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-49092

    Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure

    Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data fro…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-63143

    Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-63145

    Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise

    Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A vulnerability exists in Kibana's Machine Learning functio…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-63259

    Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access.

    Elastic Kibana
  • Medium 4.3
    CVE-2026-63262

    Missing Authorization in Kibana Leading to Information Disclosure

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References