LoginSign Up
← Back to all sparks
Elasticsearch logo

Elasticsearch

DEVOPSINFRA · APIS
Velocity5.0

Search and analytics

elastic.co ↗

Elastic patches seven Kibana CVEs in a single wave, two rated High severity

securityauthorizationfleetkibanacve-patch
◆Current state
Elasticsearch/Kibana is working through a broad security audit of its Fleet and agent management layer. The September 2026 patch wave disclosed seven CVEs across Kibana, Filebeat, and Fleet Server — all centered on incorrect or missing authorization checks. Two carry a CVSS 8.1 High rating: one allowing unauthorized configuration modification via Fleet, another enabling privilege escalation through under-validated integration package credentials.
◆Where it's heading
Fleet's growing role as the agent management backbone is exposing authorization boundary issues at scale. The pattern across these advisories — privilege checks missing or bypassed in Fleet-adjacent features — suggests a systematic review is underway rather than isolated bug hunting. Expect further patch batches as the audit reaches Fleet integrations, plugins, and cross-space access paths introduced in the 9.x line.
◆Prediction
The Cribl integration code-injection fix (ESA-2026-151) signals that third-party integration templates are under scrutiny; more integration-specific CVEs in the 9.x series are likely before the current audit cycle closes.

◆Recent moves

  1. 12d ago

    Kibana: High-severity unauthorized config modification via Fleet (CVE-2026-82302)

    A CVSS 8.1 High authorization flaw in Kibana allowed any Fleet-privileged user to modify configurations they should not have write access to — patched in 8.19.21, 9.4.6, 9.5.3. This is the second High-severity Fleet authorization fix in this batch, reinforcing the pattern of privilege boundary gaps in the Fleet management layer.

    View source ↗
  2. 12d ago

    Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-175)

    A medium-severity info disclosure (CVSS 6.5) in Kibana's Fleet debugging interfaces let authorized agents enumerate diagnostic data across space boundaries — fixed in 9.4.6 and 9.5.3, 8.x unaffected. Scoped to deployments with Fleet space awareness and debug interfaces enabled, limiting real-world exposure.

    View source ↗
  3. 12d ago

    Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-174)

    A CVSS 4.3 DoS in Kibana's Fleet agent communication message signing — an authenticated user with Fleet privileges could trigger a denial of service, patched in 8.19.21, 9.4.6, 9.5.3. Low operational impact given the required privilege level.

    View source ↗
  4. 12d ago

    Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)

    Missing authorization in Kibana's Entity Analytics feature allowed a Security read-level user in one space to trigger privileged write operations across all Kibana spaces — patched in 8.19.21, 9.4.6, 9.5.3. The cross-space scope amplifies the impact in multi-tenant deployments, but CVSS 4.3 reflects the limited direct data exposure.

    View source ↗
  5. 12d ago

    Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)

    A missing authorization check in Kibana's Fleet plugin (9.x only) let a read-level Fleet user enumerate agents and access diagnostic data from other spaces — patched in 9.4.6 and 9.5.3. The vulnerability exists only in 9.x's Fleet space awareness feature, making it a narrow-scope fix.

    View source ↗
  6. 12d ago

    Kibana: Code injection via Cribl integration template lets Fleet users escalate Elasticsearch privileges (CVE-2026-78593)

    A code injection vulnerability in Kibana's Cribl integration allowed Fleet management users to inject expressions into server-side ingest pipeline templates, escalating their Elasticsearch privileges beyond authorized scope — patched in 8.19.21, 9.4.6, 9.5.3. The flaw points to a design gap in how Kibana validates configuration fields sourced from third-party integration packages, a surface that will require broader auditing.

    View source ↗