DeutschShown in its original language — a full translation is planned for a future version.
Kibana: Mehrere Schwachstellen
view advisory published 2026-05-28
Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-49095US | — | — | ||
Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can… | ||||
| CVE-2026-49094US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit… | ||||
| CVE-2026-49093US | high7.7 | — | ||
Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing… | ||||
| CVE-2026-42400US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compres… | ||||
| CVE-2026-42399US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to c… | ||||
| CVE-2026-42398US | — | — | ||
Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuri… | ||||
| CVE-2026-42401US | medium5.4 | — | ||
Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist c… | ||||
| CVE-2026-33464US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can… | ||||
| CVE-2026-33463US | — | — | ||
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validat… | ||||
| CVE-2026-33462US | high7.3 | — | ||
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a special… | ||||
02
references
External citations — patches, advisories, analysis.
- Elastic Security Announcement ESA-2026-33 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-32 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-35 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-34 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-30 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-36 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-39 vom 2026-05-28external
- Elastic Security Announcement ESA-2026-37 vom 2026-05-28external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan