Skip to content
OpenAdvisories

Vendor

Elastic

396 known vulnerabilities.

Products

Kibana 196 Elasticsearch 91 Elastic Cloud Enterprise 13 Logstash 9 Apm Server 8 Packetbeat 8 Fleet Server 7 Elastic X-Pack Security 6 Elastic Agent 5 Eck Operator 4 Beats 3 Elastic Cloud Enterprise (ECE) 3 Filebeat 3 X-Pack Security 3 Elastic Enterprise Search 3 Elastic Endpoint Security 2 Elasticsearch X-Pack Machine Learning 2 Elastic Cloud on Kubernetes 2 Elastic App Search 2 Metricbeat 2 Elastic Agent and Elastic Defend 2 Elastic Defend 2 Elastic APM Agent for Go 1 Enterprise Search 1 Elastic Network Drive Connector 1 Elastic X-Pack Alerting 1 Kibana X-Pack Security 1 Elastic Package Registry 1 Elastic Endpoint Security and Elastic Endgame Security 1 Enterprisesearch 1 Endpoint 1 Elasticsearch-Hadoop 1 Elastic APM Java Agent 1 APM Java Agent 1 Elastic Code 1 Endpoint Security 1 Elastic APM agent for Python 1 Elastic APM agent for Ruby 1 Elastic Docker images 1 Elastic APM .NET Agent 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-78587

    Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations

    Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authe…

    Elastic Fleet Server
  • Low 3.5
    CVE-2026-78600

    Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention

    Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privi…

    Elastic Eck Operator
  • Low 2.1
    CVE-2021-22143

    Elastic APM .NET Agent information disclosure

    The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an applica…

    Elastic Elastic APM .NET Agent Elastic.Apm NuGet
  • Low 3.1
    CVE-2021-22151

    Kibana path traversal issue

    It was discovered that Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension.

    Elastic Kibana
  • Low 2.4
    CVE-2021-22133

    Information Disclosure in go.elastic.co/apm

    The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM …

    Elastic Elastic APM Agent for Go go.elastic.co/apm Go
  • Low 3.1
    CVE-2020-7020

    Privilege Context Switching Error in Elasticsearch

    Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the sear…

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven