Elastic
382 CVEs across 70 Elastic products. Browse Elastic vulnerabilities, severities, and proof-of-concept exploits.
Elastic products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94408 | Medium | 4.9 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94400 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94399 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94398 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94397 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-94396 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) |
CVE-2026-82300 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-82294 | Medium | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). |
CVE-2026-78582 | Medium | 6.5 | 2026-09-26 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC… |
CVE-2026-72668 | High | 7.3 | 2026-09-26 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit… |
CVE-2026-72662 | Medium | 6.3 | 2026-09-26 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Func… |
CVE-2026-82302 | High | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-82299 | Medium | 6.5 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
CVE-2026-82298 | Medium | 4.3 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
CVE-2026-78596 | Medium | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification… |
CVE-2026-78595 | Medium | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclos… |
CVE-2026-78593 | Medium | 4.3 | 2026-09-03 | An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject… |
CVE-2026-78583 | High | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarati… |
CVE-2026-82293 | Medium | 4.3 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Ac… |
CVE-2026-78609 | Medium | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An acto… |
CVE-2026-78604 | High | 7.8 | 2026-09-02 | Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Wi… |
CVE-2026-78602 | Medium | 5.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Trav… |
CVE-2026-78601 | Medium | 5.5 | 2026-09-02 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kib… |
CVE-2026-78600 | Low | 3.5 | 2026-09-02 | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials p… |
CVE-2026-78599 | Medium | 6.5 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of in… |
CVE-2026-78598 | Medium | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Contro… |
CVE-2026-78594 | Medium | 4.9 | 2026-09-02 | Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authent… |
CVE-2026-78591 | Medium | 6.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of re… |
CVE-2026-78590 | High | 7.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of pr… |
CVE-2026-78588 | Medium | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker ab… |
CVE-2026-78587 | Low | 3.1 | 2026-09-02 | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does… |
CVE-2026-78586 | Medium | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-78584 | Medium | 4.3 | 2026-09-02 | Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An auth… |
CVE-2026-78608 | Medium | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an in… |
CVE-2026-78607 | Medium | 5.4 | 2026-09-01 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holdin… |
CVE-2026-78606 | Medium | 4.2 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Co… |
CVE-2026-78605 | Medium | 5.9 | 2026-09-01 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smugglin… |
CVE-2026-78603 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-78597 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constr… |
CVE-2026-78592 | High | 7.3 | 2026-09-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources… |
CVE-2026-72682 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72654 | Medium | 6.5 | 2026-09-01 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An o… |
CVE-2026-72652 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2026-72649 | High | 8.8 | 2026-09-01 | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586)… |
CVE-2026-72644 | Medium | 6.5 | 2026-09-01 | Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-priv… |
CVE-2026-72641 | Medium | 5.4 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… |
CVE-2026-72633 | Medium | 4.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by… |
CVE-2026-72628 | Medium | 6.5 | 2026-09-01 | Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user hol… |
CVE-2026-63138 | Medium | 6.5 | 2026-09-01 | Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An auth… |
CVE-2026-63137 | High | 8.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-56143 | Medium | 4.9 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user wi… |
CVE-2026-33465 | Medium | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated… |
CVE-2024-14047 | High | 7.2 | 2026-09-01 | A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged att… |
CVE-2026-78581 | Medium | 4.2 | 2026-08-25 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constr… |
CVE-2026-72687 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decode… |
CVE-2026-72686 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal com… |
CVE-2026-72685 | Medium | 4.3 | 2026-08-13 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied… |
CVE-2026-72684 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Pr… |
CVE-2026-72683 | Medium | 6.5 | 2026-08-13 | A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api… |
CVE-2026-72681 | Medium | 6.5 | 2026-08-13 | Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a… |
CVE-2026-72680 | Medium | 6.5 | 2026-08-13 | Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that iden… |
CVE-2026-72679 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pat… |
CVE-2026-72678 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An au… |
CVE-2026-72677 | High | 7.3 | 2026-08-13 | Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet acce… |
CVE-2026-72676 | Medium | 6.5 | 2026-08-13 | Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injec… |
CVE-2026-72675 | High | 7.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Ki… |
CVE-2026-72674 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied… |
CVE-2026-72673 | Medium | 5.4 | 2026-08-13 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrai… |
CVE-2026-72672 | High | 7.7 | 2026-08-13 | The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kiban… |
CVE-2026-72671 | Medium | 4.3 | 2026-08-13 | A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies on… |
CVE-2026-72670 | High | 7.7 | 2026-08-13 | A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally… |
CVE-2026-72669 | High | 7.6 | 2026-08-13 | The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state… |
CVE-2026-72667 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially craf… |
CVE-2026-72666 | Medium | 6.8 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kib… |
CVE-2026-72665 | High | 8.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Func… |
CVE-2026-72664 | Medium | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality No… |
CVE-2026-72663 | Medium | 6.5 | 2026-08-13 | Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply neste… |
CVE-2026-72661 | Medium | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An interna… |
CVE-2026-72660 | Medium | 6.5 | 2026-08-13 | Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153… |
CVE-2026-72659 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafte… |
CVE-2026-72658 | High | 7.3 | 2026-08-13 | Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create vi… |
CVE-2026-72657 | Medium | 6.5 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC… |
CVE-2026-72656 | Medium | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CA… |
CVE-2026-72655 | Medium | 4.3 | 2026-08-13 | Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can… |
CVE-2026-72653 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated u… |
CVE-2026-72651 | Medium | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated u… |
CVE-2026-72650 | Medium | 4.3 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by… |
CVE-2026-72648 | Medium | 6.5 | 2026-08-13 | Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Ret… |
CVE-2026-72647 | Medium | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user hol… |
CVE-2026-72645 | Medium | 6.5 | 2026-08-13 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated use… |
CVE-2026-72643 | High | 7.1 | 2026-08-13 | Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a compari… |
CVE-2026-72642 | High | 8.8 | 2026-08-13 | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from… |
CVE-2026-72640 | Medium | 6.5 | 2026-08-13 | The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorde… |
CVE-2026-72639 | Medium | 6.5 | 2026-08-13 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is… |
CVE-2026-72638 | Medium | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low… |
CVE-2026-72636 | Medium | 6.5 | 2026-08-13 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matche… |
CVE-2026-72632 | High | 7.1 | 2026-08-13 | Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value o… |
CVE-2026-72631 | Medium | 6.5 | 2026-08-13 | Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may option… |
CVE-2026-72630 | High | 7.1 | 2026-08-13 | Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing in… |
CVE-2026-72629 | High | 7.1 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Const… |