DeutschShown in its original language — a full translation is planned for a future version.
Kibana: Mehrere Schwachstellen
view advisory published 2026-07-21
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand auszulösen oder Daten offenzulegen und zu manipulieren.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-63262US | —OT elevated | — | ||
Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. | ||||
| CVE-2026-63261US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially c… | ||||
| CVE-2026-63260US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can tr… | ||||
| CVE-2026-63259US | — | — | ||
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data fro… | ||||
| CVE-2026-63145US | —OT elevated | — | ||
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained… | ||||
| CVE-2026-63143US | —OT elevated | — | ||
Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflo… | ||||
| CVE-2026-63142US | —OT elevated | — | ||
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured… | ||||
| CVE-2026-63141US | medium5.4OT elevated | — | ||
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges… | ||||
| CVE-2026-63139US | — | — | ||
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncont… | ||||
| CVE-2026-56147US | — | — | ||
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (C… | ||||
| CVE-2026-56146US | —OT elevated | — | ||
Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged… | ||||
| CVE-2026-49092US | —OT elevated | — | ||
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs… | ||||
| CVE-2026-42397US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a sp… | ||||
02
references
External citations — patches, advisories, analysis.
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
- Elastic Security Announcement vom 2026-07-21external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan