Skip to content
OpenAdvisories
High WID-SEC-2026-3782 3 CVEs

Kibana: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Oct 6, 2026 · Updated Oct 6, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Informationen offenzulegen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 3

  • High 8.8
    CVE-2026-102406

    Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

    Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Ki…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-102412

    Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

    Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive crede…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-102410

    Missing Authorization in Kibana Leading to Information Disclosure

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization che…

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References