DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kibana: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-12
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.
01
beschreibt (25)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-72681US | high8.8OT erhöht | — | ||
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes th… | ||||
| CVE-2026-72680US | medium5.4 | — | ||
Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not disti… | ||||
| CVE-2026-72675US | —OT erhöht | — | ||
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning… | ||||
| CVE-2026-72674US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fiel… | ||||
| CVE-2026-72673US | —OT erhöht | — | ||
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1)… | ||||
| CVE-2026-72672US | —OT erhöht | — | ||
The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elastics… | ||||
| CVE-2026-72671US | —OT erhöht | — | ||
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges tha… | ||||
| CVE-2026-72670US | medium6.5 | — | ||
A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet pri… | ||||
| CVE-2026-72669US | —OT erhöht | — | ||
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify owners… | ||||
| CVE-2026-72667US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted… | ||||
| CVE-2026-72666US | — | — | ||
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the request… | ||||
| CVE-2026-72665US | —OT erhöht | — | ||
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properl… | ||||
| CVE-2026-72664US | —OT erhöht | — | ||
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constraine… | ||||
| CVE-2026-72663US | — | — | ||
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitte… | ||||
| CVE-2026-72660US | — | — | ||
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated u… | ||||
| CVE-2026-72659US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload… | ||||
| CVE-2026-72658US | — | — | ||
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save… | ||||
| CVE-2026-72655US | — | — | ||
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized… | ||||
| CVE-2026-72651US | — | — | ||
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only pr… | ||||
| CVE-2026-72650US | — | — | ||
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An a… | ||||
20 von 25 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
- Elastic Security Announcement vom 2026-08-12external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan