WID-SEC-W-2026-0545

DeutschShown in its original language — a full translation is planned for a future version.

Kibana: Mehrere Schwachstellen ermöglichen Denial of Service und Offenlegung von Informationen

view advisory published 2026-02-26

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-26938US	high7.7	0.29% (22nd)	—	2026-02-26
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana…
CVE-2026-26937US	high7.5	0.32% (25th)	—	2026-02-26
Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
CVE-2026-26936US	high7.5	0.37% (31st)	—	2026-02-26
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-…
CVE-2026-26935US	high7.5	0.32% (25th)	—	2026-02-26
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
CVE-2026-26934US	—	0.32% (24th)	—	2026-02-26
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Ma…

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan