DeutschShown in its original language — a full translation is planned for a future version.
Kibana: Mehrere Schwachstellen
view advisory published 2026-09-01
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
describes (23)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-82293US | —OT elevated | — | ||
Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security… | ||||
| CVE-2026-78601US | —OT elevated | — | ||
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store conf… | ||||
| CVE-2026-78599US | — | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via… | ||||
| CVE-2026-78598US | —OT elevated | — | ||
Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CA… | ||||
| CVE-2026-78591US | — | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Trav… | ||||
| CVE-2026-78590US | — | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources vi… | ||||
| CVE-2026-78586US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level… | ||||
| CVE-2026-78584US | — | — | ||
Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holdin… | ||||
| CVE-2026-78608US | —OT elevated | — | ||
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM int… | ||||
| CVE-2026-78606US | —OT elevated | — | ||
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CA… | ||||
| CVE-2026-78603US | —OT elevated | — | ||
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user… | ||||
| CVE-2026-78597US | —OT elevated | — | ||
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… | ||||
| CVE-2026-78592US | — | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (… | ||||
| CVE-2026-72682US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only lo… | ||||
| CVE-2026-72654US | — | — | ||
Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to… | ||||
| CVE-2026-72652US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a sp… | ||||
| CVE-2026-72644US | — | — | ||
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access… | ||||
| CVE-2026-72641US | —OT elevated | — | ||
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated u… | ||||
| CVE-2026-72633US | —OT elevated | — | ||
Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An au… | ||||
| CVE-2026-72628US | — | — | ||
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams manageme… | ||||
showing 20 of 23
02
references
External citations — patches, advisories, analysis.
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
- Elastic Security Announcement vom 2026-09-01external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan