Elastic Kibana
114 CVEs affecting Elastic Kibana. Latest disclosed: 2026-05-28. Critical: 6, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25015 | Critical | 9.9 | 2025-03-05 | Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0… |
CVE-2024-37288 | Critical | 9.9 | 2024-09-09 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue o… |
CVE-2025-25014 | Critical | 9.1 | 2025-05-06 | A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. |
CVE-2024-37285 | Critical | 9.1 | 2024-11-14 | A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful… |
CVE-2024-37287 | Critical | 9.1 | 2024-08-13 | A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to in… |
CVE-2023-31422 | Critical | 9.0 | 2023-10-26 | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.1… |
CVE-2025-25018 | High | 8.7 | 2025-10-10 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) |
CVE-2025-25009 | High | 8.7 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. |
CVE-2024-12556 | High | 8.7 | 2025-04-08 | Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. |
CVE-2026-26938 | High | 8.6 | 2026-02-26 | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary… |
CVE-2026-0532 | High | 8.6 | 2026-01-14 | External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure thr… |
CVE-2025-25017 | High | 8.2 | 2025-10-10 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) |
CVE-2023-46675 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logg… |
CVE-2023-46671 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 wh… |
CVE-2026-42398 | High | 7.7 | 2026-05-28 | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection al… |
CVE-2026-33461 | High | 7.7 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploi… |
CVE-2026-4498 | High | 7.7 | 2026-04-08 | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBA… |
CVE-2024-43707 | High | 7.7 | 2025-01-23 | An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of… |
CVE-2024-43706 | High | 7.6 | 2025-06-10 | Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint. |
CVE-2017-8452 | High | 7.5 | 2017-06-16 | Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after certain requests and will accumulate over ti… |