Kibana 6.8.23 → 9.5.6

243 releases · 0 breaking changes · 309 security fixes · 9 advisories fixed

309security0breaking0deprecated274feature851fix

Is 6.8.23 affected?

Vulnerabilities fixed by this upgrade

7.7 CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…
4.3 CVE-2026-72671 A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…
7.6 CVE-2024-43706 Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
6.5 CVE-2024-43708 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with…
6.5 CVE-2024-52972 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce…
6.5 CVE-2024-52973 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a…
6.1 CVE-2024-23442 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
5.4 CVE-2021-37936 It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could…
6.5 CVE-2021-22139 Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to cre…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li… in 9.5.5
security Fixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… in 9.5.4
security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.5.3
security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.3
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.5.2
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.5.2
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.5.2
security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.5.2
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.5.2
security Fixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li… in 9.4.8
security Fixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… in 9.4.7
security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 9.4.7
security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.4.6
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.4.6
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.4.6
security Fixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age… in 9.4.6
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.4.6
security Fixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only… in 9.4.6
security Fixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… in 9.4.6
security Fixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal… in 9.4.6
security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.6
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.4.6
security Fixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by… in 9.4.5
security Fixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… in 9.4.5
security Fixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins… in 9.4.5
security Fixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic… in 9.4.5
security Fixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… in 9.4.5
security Fixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… in 9.4.5
security Fixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r… in 9.4.5
security Fixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A… in 9.4.5
security Fixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i… in 9.4.5
security Fixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in… in 9.4.5
security Fixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a… in 9.4.5
security Fixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use… in 9.4.5
security Fixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe… in 9.4.5
security Fixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i… in 9.4.5
security Fixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a… in 9.4.5
security Fixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… in 9.4.5
security Fixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… in 9.4.5
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.4.5
security Fixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… in 9.4.5
security Fixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… in 9.4.5
security Fixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… in 9.4.5
security Fixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t… in 9.4.5
security Fixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… in 9.4.5
security Fixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati… in 9.4.5
security Fixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… in 9.4.5
security Fixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.5
security Fixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… in 9.4.5
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.4.4
security Fixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func… in 9.4.4
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.4.4
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.4.4
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.4.4
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.4.4
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.4.4
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.4.4
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.4.4
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.4.4
security Fixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… in 9.4.4
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.4.4
security Fixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu… in 9.4.4
security Fixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. in 9.4.4
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.4.4
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.4.4
security Fixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t… in 9.4.4
security Fixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio… in 9.4.3
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.4.3
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.4.3
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.4.3
security Fixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… in 9.4.3
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.4.3
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.4.3
security Fixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us… in 9.4.3
security Fixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under… in 9.4.3
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.4.2
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.4.2
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.4.2
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.4.2
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.4.2
security Fixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper… in 9.4.0
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.3.8
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.3.8
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.3.8
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.3.8
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.3.8
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.3.8
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.3.8
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.3.8
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.3.8
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.3.8
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.3.8
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.3.8
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.3.7
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.7
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.3.6
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.3.6
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.3.6
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.3.6
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.3.5
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.3.5
security Fixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.5
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.3.5
security Fixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… in 9.3.5
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.3.5
security Fixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… in 9.3.5
security Fixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… in 9.3.5
security Fixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… in 9.3.5
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.3.5
security Fixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… in 9.3.5
security Fixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… in 9.3.4
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.3.3
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.3.3
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.3.3
security Fixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server… in 9.3.3
security Fixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest… in 9.3.3
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.3.3
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.3.2
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.3.2
security Fixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could… in 9.3.0
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.2.8
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.2.8
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.2.8
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.2.8
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.2.8
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.2.7
security Fixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s… in 9.2.6
security Fixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC… in 9.2.6
security Fixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 9.2.6
security Fixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 9.2.5
security Fixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). in 9.2.5
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 9.2.4
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 9.2.4
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 9.2.4
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 9.2.4
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 9.2.3
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 9.2.3
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 9.2.3
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 9.2.2
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 9.2.2
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 9.1.10
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 9.1.10
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 9.1.10
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 9.1.10
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 9.1.9
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 9.1.9
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 9.1.9
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 9.1.8
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 9.1.8
security Fixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This… in 9.1.7
security Fixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. in 9.1.7
security Fixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… in 9.1.6
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 9.1.5
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 9.1.5
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 9.1.4
security Fixes CVE-2025-25010: Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces. in 9.1.3
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 9.0.8
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 9.0.8
security Fixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… in 9.0.8
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 9.0.7
security Fixes CVE-2025-25010: Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces. in 9.0.6
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 9.0.3
security Fixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… in 8.19.22
security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 8.19.22
security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 8.19.21
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 8.19.21
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 8.19.21
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 8.19.21
security Fixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… in 8.19.21
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 8.19.21
security Fixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by… in 8.19.20
security Fixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… in 8.19.20
security Fixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… in 8.19.20
security Fixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… in 8.19.20
security Fixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r… in 8.19.20
security Fixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i… in 8.19.20
security Fixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in… in 8.19.20
security Fixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i… in 8.19.20
security Fixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… in 8.19.20
security Fixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… in 8.19.20
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 8.19.20
security Fixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… in 8.19.20
security Fixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… in 8.19.20
security Fixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… in 8.19.20
security Fixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… in 8.19.20
security Fixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… in 8.19.20
security Fixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… in 8.19.20
security Fixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 8.19.20
security Fixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… in 8.19.20
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 8.19.20
security Fixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic… in 8.19.19
security Fixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 8.19.19
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 8.19.19
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 8.19.19
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 8.19.19
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 8.19.19
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 8.19.19
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 8.19.19
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 8.19.19
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 8.19.19
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 8.19.18
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 8.19.18
security Fixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… in 8.19.18
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 8.19.17
security Fixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could… in 8.19.17
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 8.19.17
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 8.19.17
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 8.19.16
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 8.19.16
security Fixes CVE-2026-49094: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request contain… in 8.19.16
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 8.19.16
security Fixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… in 8.19.16
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 8.19.16
security Fixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… in 8.19.16
security Fixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… in 8.19.16
security Fixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… in 8.19.16
security Fixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… in 8.19.16
security Fixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… in 8.19.15
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 8.19.14
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 8.19.14
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 8.19.14
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 8.19.14
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 8.19.13
security Fixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s… in 8.19.12
security Fixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC… in 8.19.12
security Fixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 8.19.12
security Fixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 8.19.11
security Fixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). in 8.19.11
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 8.19.10
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 8.19.10
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 8.19.10
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 8.19.9
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 8.19.9
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 8.19.9
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 8.19.8
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 8.19.8
security Fixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This… in 8.19.7
security Fixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. in 8.19.7
security Fixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… in 8.19.6
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 8.19.5
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 8.19.5
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 8.19.4
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 8.19.0
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 8.18.8
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 8.18.8
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 8.18.8
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 8.18.3
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 8.17.8
security Fixes CVE-2025-25014: A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. in 8.17.6
security Fixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u… in 8.17.3
security Fixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. in 8.17.2
security Fixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… in 8.17.2
security Fixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u… in 8.16.6
security Fixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. in 8.16.4
security Fixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… in 8.16.3
security Fixes CVE-2024-52974: An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi… in 8.15.1
security Fixes CVE-2024-43707: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on t… in 8.15.0
security Fixes CVE-2024-43708: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with… in 8.15.0
security Fixes CVE-2024-52972: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce… in 8.15.0
security Fixes CVE-2024-43710: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying… in 8.15.0
security Fixes CVE-2024-37287: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot… in 8.14.2
security Fixes CVE-2024-52973: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a… in 8.14.2
security Fixes CVE-2024-37281: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint. in 8.14.0
security Fixes CVE-2024-23442: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 8.14.0
security Fixes CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. in 8.14.0
security Fixes CVE-2024-37279: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alertin… in 8.14.0
security Fixes CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. in 8.13.0
security Fixes CVE-2024-23446: An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s… in 8.12.1
security Fixes CVE-2024-11390: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc… in 8.12.0
security Fixes CVE-2023-46675: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has… in 8.11.2
security Fixes CVE-2026-49091: Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written… in 8.11.1
security Fixes CVE-2023-46671: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error mes… in 8.11.1
security Fixes CVE-2022-38779: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 8.6.2
security Fixes CVE-2022-38778: A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. in 8.6.1
security Fixes CVE-2022-23711: A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the he… in 8.1.3
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 7.17.29
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 7.17.29
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 7.17.29
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 7.17.29
security Fixes CVE-2024-11390: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc… in 7.17.24
security Fixes CVE-2024-37287: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot… in 7.17.23
security Fixes CVE-2024-52974: An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi… in 7.17.23
security Fixes CVE-2024-43708: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with… in 7.17.23
security Fixes CVE-2024-52972: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce… in 7.17.23
security Fixes CVE-2024-52973: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a… in 7.17.23
security Fixes CVE-2024-37281: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint. in 7.17.23
security Fixes CVE-2024-23442: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 7.17.22
security Fixes CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. in 7.17.22
security Fixes CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. in 7.17.19
security Fixes CVE-2023-46675: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has… in 7.17.16
security Fixes CVE-2026-49091: Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written… in 7.17.15
security Fixes CVE-2022-38778: A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. in 7.17.9
security Fixes CVE-2022-38779: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 7.17.9
security Fixes CVE-2022-23713: A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser. in 7.17.5
security Fixes CVE-2022-23711: A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the he… in 7.17.3
security Fixes CVE-2022-23709: A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite… in 7.17.1
security Fixes CVE-2022-23707: An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pat… in 7.17.0
security Fixes CVE-2021-37938: It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily tr… in 7.15.2
security Fixes CVE-2021-37939: It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this… in 7.15.2
security Fixes CVE-2021-22150: It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner… in 7.14.1
security Fixes CVE-2021-37936: It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could… in 7.14.1
security Fixes CVE-2021-22142: Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render ar… in 7.13.0
security Fixes CVE-2021-22141: An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary web… in 7.13.0
security Fixes CVE-2021-22139: Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to cre… in 7.12.1
security Fixes CVE-2021-22136: In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background p… in 7.12.0
security Fixes CVE-2020-7015: Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensit… in 7.7.1
security Fixes CVE-2020-7013: Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana… in 7.7.0
security Fixes CVE-2019-7621: Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualization… in 7.5.1
security Fixes CVE-2019-7616: Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set… in 7.2.1

Every release in between

9.5.6 Nov 2, 2026 Release notes ↗

featureAdd options to include frozen tier data in Agent Builder tools. Frozen tier data stays excluded unless you opt in #297481, #299437.

featureSort agent policies alphabetically in the Assign new policy to agent modal #296067.

featureClarify in the Salesforce connector's document-level security tooltip that access applies per object type, not per record #297728.

featureAdd the i18n.detectBrowserLocale setting. Set it to false to stop Kibana from choosing the interface language from the browser's language preferences, while still letting you pick your own language #295756.

fixFix Agent Builder agents refusing to run ES|QL queries with execute_esql when the queries don't come from generate_esql, such as queries written in custom instructions or skills #300045.

fixFix ES|QL queries in Agent Builder failing on clusters that lack the remote cluster privilege, even when no remote clusters are requested #295560.

fixFix the Agent Builder natural language search tool querying indices that aren't allowed to the tool. The tool now returns an error when no allowed indices are available #295885.

fixFix bulk import not letting you select MCP tools that have no description #300886.

fixFix rules creating duplicate alerts, and leaving the original alerts active, when a rule run stops before it saves its state #293521.

fixFix rules and background tasks silently stopping for several minutes when a concurrent update prevents their completed run from being recorded #295415.

fixFix recurring tasks with rrule schedules running the same occurrence twice, or getting stuck after a timeout #297486.

fixFix the dashboard top menu and Edit button not appearing in embedded dashboards when show-top-menu=true is set #299599.

fixFix Lens metric panels failing to render when filters return no results and dynamic coloring uses a maximum dimension #297429.

fixFix an invalid-column error when you add a Maximum value dimension to an ES|QL metric visualization in Lens #296545.

fixFix Lens ES|QL metric background trendlines failing for queries with multiple piped STATS commands #294577.

fixFix Lens ES|QL metric background trendlines failing when the time field is renamed before aggregation #297591.

fixFix Lens as code range columns dropping open bounds, including ranges with no lower bound, no upper bound, or neither #300099.

fixFix Lens as code terms columns ranked by a custom last_value metric losing the sort field in the API round trip. The API now accepts an optional time_field on the custom rank-by #292378.

fixFix the dashboard API dropping ES|QL Lens panels whose color mapping assigns colors to boolean, null, multi-value, or open-ended range values #298850.

fixFix the Save and return button appearing instead of Save when you create a visualization #296261.

fixFix an agent policy showing an outdated minimum Elastic Agent version after you upgrade several integration policies at once #294439.

fixFix integration policy edits not reaching Elastic Agent for packages that declare their Elastic Agent version requirement in the package manifest #296354.

fixFix agents enrolled by an older Fleet Server being left on a deleted version-specific agent policy #295107.

fixFix automatic integration policy upgrades redeploying the agent policy once for each integration policy, which slowed upgrades and could make them time out when the Elastic Package Registry is unreachable #294411.

fixFix integrations whose default deployment option is Elastic Managed Integration saving an agent-based policy when they also have a cloud connector option #299039.

fixFix deleting an agent policy silently leaving its ID in shared integration policies. The delete now fails with an error that explains the cause #300189.

fixFix Fleet bulk agent action APIs not validating the agents input consistently. Invalid input now returns a 400 error instead of running the action #299837.

fixFix the managed integration enrollment flyout not showing component health details, and the Details action being unavailable for managed integration policies #294970.

fixFix the Agent policies page taking tens of seconds, or failing with an HTTP 500 error, when agent policies contain thousands of integration policies #297979.

fixFix agent policies for managed integrations appearing in agent policy searches and filters when Show agentless agents and policies in Fleet is turned off #296087.

fixFix Fleet rejecting integration policies whose data_stream.dataset uses an agent variable placeholder such as ${env.NAME} #295496.

fixFix Fleet running Elasticsearch transforms from uploaded integration packages with Kibana's internal system identity. Transforms in uploaded packages now run as the user who installed the package #297771.

fixFix scheduled unenrollment not deactivating inactive agents that have a stale unenrolled_at value #300148.

fixFix Fleet setup tripping the Elasticsearch request circuit breaker on deployments with large agent policy documents #300777.

fixFix Fleet hanging when the Elastic product versions API stops responding. The lookup of available Elastic Agent versions now honors its timeout and falls back to the versions bundled with Kibana #292736.

fixFix installed integration icons rendering as black shapes #293176.

fixFix the runtime field editor ignoring Save when you edit a field's script while the preview is still updating #294753.

fixFix the runtime field editor discarding the script when you change the field type to or from composite #299025.

fixFix the runtime field preview not showing a field's custom label, and the preview row disappearing while documents load #299810.

fixFix saved object labels showing "index patterns" instead of "data views" when you copy a dashboard that references data views in another space #297621.

+22 more items in the release notes

9.5.5 Oct 6, 2026 Release notes ↗

securityFixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…

fixFix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.

fixFix Agent Builder tracing applying the default space's GenAI privacy settings in every space. Each conversation now uses the privacy settings of its own space #290750.

fixAdd the case template ID and version fields to the Agent Builder cases-analytics skill so agents can filter and group cases by template #291716.

fixFix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.

fixFix Agent Builder rules failing after about an hour because they kept the agent's temporary API key #291318.

fixFix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874.

fixFix Jira Service Management and Opsgenie connector actions failing when the rendered alert message exceeds 130 characters. The connectors now truncate the message instead #291698.

fixFix the email connector HTTP test sending caller-supplied subject and message content. The test now sends fixed content #288664.

fixFix the Auto-push case to connected external system option missing from the Cases rule action when case templates are enabled #292187.

fixIncrease the TinyMath expression length limit so longer visualization formulas don't fail #290314.

fixFix Go to URL drilldowns leaving Mustache tokens such as event.values.[0] unreplaced in the drilldown name #290363.

fixFix ES|QL metric chart background trendlines failing for queries that use FORK #287819.

fixFix new Last value columns being exported with Show array values turned on even when the option is off, which caused Elasticsearch errors when you imported them #292864.

fixFix filter pills showing filter value is invalid or incomplete when the filter value is an empty string #290383.

fixFix clicking the unsaved changes indicator on the dashboard save button opening two save dialogs #293087.

fixFix deleting a managed integration policy leaving the agent listed as active #290181.

fixFix agents for Elastic managed integrations enrolled in other Kibana spaces appearing in the Fleet Agents list #293142.

fixFix version-specific agent policy assignment failing repeatedly for agent policies in non-default Kibana spaces #293010.

fixFix the Fleet output edit flyout freezing or showing no counts when thousands of agent policies use the output #291972.

fixFix Elastic Agent upgrade and agent policy requests hanging for up to two minutes and failing with a reset connection when Kibana can't retrieve the list of available Elastic Agent versions #292788.

fixFix integration upgrades failing when you add a custom analyzer or normalizer to a @custom component template after the write index is created. Fleet now rolls over the data stream instead #291813.

fixFix Fleet installing only the first trained model when an integration package includes several #290145.

fixFix ambiguous_conflict errors on dashboard assets when you install an integration in multiple Kibana spaces #291648.

fixFix integration policy upgrades and edits failing when a package policy condition is stored as a boolean #290497.

fixFix Fleet showing an error when you delete an OpenTelemetry input integration policy that shares a dataset with another policy #291679.

fixFix the Edit pipeline button in the ingest pipeline details flyout moving off-screen when a processor contains a long value #291000.

fixFix Index Management moving component templates listed in ignore_missing_component_templates to the end of composed_of when you edit or clone an index template #290171.

fixFix Index Management showing Standard as the index mode of time series data streams instead of the mode Elasticsearch reports #290169.

fixFix the document trends chart and its URL getting out of sync on the data set quality details page when you select a quality card while the page loads #291004.

fixFix Console reporting Elasticsearch request timeouts as connection failures. Console now explains that the request might still be running and suggests checking its status before you retry #289481.

fixFix Discover ES|QL breakdowns failing when a second STATS groups by an aggregate from the first STATS #290259.

fixAdd an Expand site group members toggle to SharePoint Online connectors for compact document-level security #288070.

fixAdd a Sync all mail folders option to the Outlook connector #291396.

fixAdd an Index full raw email (including headers) option to the Gmail and Outlook connectors, which by default index only the message body and minimal headers #291419.

fixFix deleted content connectors remaining in the connectors list #290859.

fixHide the Activate user action on deactivated users when you have read-only access #289801.

fixFix a failed audit log write after startup crashing Kibana. Kibana now reports a degraded state and turns the audit logger off instead #287360.

fixFix Kibana shutting down when the product documentation installer downloads a corrupt or incomplete artifact #291142.

fixFix PDF and PNG reports using too much memory and failing on memory-constrained instances when you generate them from a wide browser window #289062.

+8 more items in the release notes

9.5.4 Sep 15, 2026 Release notes ↗

securityFixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym…

fixFix MCP tools dropping extra arguments that the schema allows through additionalProperties before execution #287815.

fixRelabel the top-level Alerting privilege as Alerting V2 in the Roles UI and mark it experimental #288163.

fixFix the Tracking containment rule editor breaking when you select a data view #289778.

fixFix Sync alerts and Extract observables not applying when you change a case template from the sidebar #288636.

fixFix Alerting V2 rules from not saving when you remove all rule tags #288962.

fixFix the Update filter button being unreachable when the filter editor is taller than the screen #289163.

fixFix sibling dashboard panels not dimming during inline editing on dashboards that have no controls #288939.

fixFix ES|QL visualizations dropping field variable controls (??field) after you save them through the Visualizations API #288785.

fixFix Options list filters stopping after you delete a collapsible dashboard section #287923.

fixFix Fleet blocking a package policy save when every enrolled agent is incompatible with the package version, including agents that report a pre-release version. Fleet shows a warning instead of blocking the save #289596.

fixFix managed integrations appearing in the Fleet Agents list when they use a version-specific policy #289394.

fixFix package policy space assignments becoming stale after you move an agent policy to another Kibana space #288966.

fixFix Elastic Defend metadata transforms accumulating as duplicates in Elasticsearch across stack upgrades #288379 #288902.

fixFix comment-only values in Fleet agent policy advanced YAML settings leaving agents stuck on an outdated policy #288430.

fixFix classic streams leaving a stale Elasticsearch data stream mappings override after you remove all field overrides #288788.

fixFix Console treating request-like lines inside an unterminated triple-quoted string as standalone requests #287547.

fixCancel in-progress async searches in Discover and on dashboards when you navigate away in the browser, so Elasticsearch does not keep running them #287949.

fixFix custom time-range presets from the Time filter quick ranges advanced setting showing raw time values instead of their labels, and add a (rounded) suffix to rounded relative ranges #289066.

fixAdd an Expand role members toggle to ServiceNow connectors for compact document-level security #288071.

fixFix Query Rules document preview failing when the document ID contains slashes #287214.

fixFix unexpected logouts after an access token is refreshed during a search or dashboard refresh #286038.

fixFix user profile rows using the wrong height in user pickers #288451.

fixFix Anomaly Explorer hanging when you add a geo job chart to a case #289363.

9.5.3 Sep 3, 2026 Release notes ↗

securityFixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…

securityFixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

featureWarn in the field library and template editors when a required case field has no default value, because automated case creation can't fill it in, and show a field's name and type as permanent as soon as you create it #285453.

featureEnforce required global fields on API and workflow case creation when case templates are enabled, and accept extended_fields on the public and workflow case create and update APIs #283350.

featureRaise the Dev Tools Console Copy to curl limit so a request-body string of up to 100000 characters copies successfully #287526.

fixFix the research agent re-asking clarifying questions you already answered in the same round #284800.

fixFix disabled pre-execution workflows disappearing from Agent Builder settings so you cannot remove them. A disabled workflow stays visible and is labeled (disabled) #286826.

fixFix legacy custom fields and their v2 field-definition counterparts falling out of sync, by linking each legacy field to its definition and keeping both representations equal on every write #282772.

fixFix cases created from a case template by a rule action not inheriting the template's external connector, Sync alerts and Extract observables settings, and assignees #284854.

fixFix matching fields missing from Cases Activity search results #284940.

fixFix case attachment UI issues, including delete controls on saved-object attachments and the more-actions menu for read-only access #285456.

fixFix saved Lens visualizations missing from case attachments, and add helper text in the markdown editor for inline Timeline and Lens references #286164.

fixFix creating a case from a workflow, a case template, or machine learning so Sync alerts is not turned on unless that solution enables it #286670.

fixFix the Additional fields editor on the ServiceNow ITSM, ServiceNow SecOps, and Jira connectors rejecting Mustache context variables as invalid JSON #286578.

fixFix required-on-close validation skipping global fields that a template includes by $ref #287306.

fixFix a template $ref global field ignoring its hide-on-value condition when the controlling field is in another section #287308.

fixFix global field column selections not syncing between the Cases list and table views #287327.

fixFix the Cases list keeping the previous page after you change filters #287945.

fixFix custom threshold no data alerts firing for groups that belong to a different custom threshold rule #287151.

fixFix custom threshold Rate aggregations not firing when a counter increases from 0 to a positive value #283973.

fixFix experimental alerting system .rule-events and .alert-actions data streams requesting a replica on single-node clusters, which left those shards unassigned #287544.

fixFix alerting resource installation using unbounded concurrency, which could exhaust Kibana heap when many contexts and namespaces install at once #287643.

fixFix by-reference visualization panels disappearing from dashboards when the panel's savedObjectRef reference is missing #285476.

fixFix metric chart background trendlines failing for ES|QL time-series queries that use TBUCKET(...) #284839.

fixFix the Maps timeslider close button registering clicks only on the top quarter of the control #287441.

fixFix Canvas functions API creating data tables with more than 50 columns per row #287935.

fixFix package policy inputs for newer agent versions not being backfilled after a Kibana minor upgrade #284710.

fixAvoid querying Elasticsearch for integration sync when no cross-cluster replication follower index exists #285526.

fixFix space awareness on Fleet agent tag, upload, file, and unenroll API handlers #284936.

fixFix Fleet wrapping a Kafka Dynamic topic multi-field format string such as %{[data_stream.type]}-%{[data_stream.namespace]}, which produced an invalid topic expression #285581.

fixFix Fleet package manifests accepting cluster privileges outside the documented allow list #286084.

fixFix Fleet agent CSV export failing when xpack.reporting.csv.scroll.strategy is scroll, or when Search in frozen indices is enabled #286119.

fixFix the Fleet agent-status-change task failing when the Elasticsearch response is too large #286324.

fixFix sorting the Agents table by Host so it uses the hostname keyword field instead of the analyzed text field #286383.

fixFix package policies accepting a whitespace-only namespace, which saved while ingestion failed silently #286385.

fixFix the CPU and memory tooltip on offline agents showing misleading messages instead of clearly stating the agent is offline #286386.

fixFix managed integration throughput index patterns for streams that use a dynamic dataset #286758.

fixFix update and delete of legacy managed integration policies returning HTTP 404 or reporting success while the deployment kept running #287011.

fixFix stale version-specific Fleet policies remaining after their agent version dropped out of the bounded set, and refresh variants that still have enrolled agents #287095.

fixFix slow Fleet outputs fetching on Fleet setup and Integrations UI page load #287113.

+21 more items in the release notes

9.5.2 Aug 20, 2026 Release notes ↗

securityFixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…

securityFixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…

securityFixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…

securityFixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two…

featureAdd a public API to create, update, and delete case templates (POST, PUT, and DELETE /api/cases/templates), including a dry-run mode that validates a template without saving it #280144.

featureImprove the Cases view, cases list, and field library by keeping the case details panel in view as you scroll, saving status and other fields immediately when changed, and adding drag-and-drop field reordering to the field library #282197.

featureAdd an Agent Builder tool to attach saved dashboards, maps, Discover sessions, and Lens visualizations to a case #279680.

featureRestore Defer loading panels below "the fold" (labs:dashboard:deferBelowFold) so off-screen dashboard panels wait to fetch data until they scroll into view. The setting is off by default #284004.

featureAdd a toggle to the Manage region preferences modal so you can remove a custom region policy and revert to allowing all regions #282769.

featureAdd step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.

featureEnable running a workflow with only the execute privilege, without also requiring the read privilege on the workflow definition #284822.

fixFix missing screen reader announcements when toggling the Show active only filter on the agent tools page #282276.

fixFix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when you configure cross-cluster search index patterns but the cluster doesn't have the remote cluster client role #281609.

fixFix chat completion streams continuing after you cancel a request, and cap their duration at 10 minutes #285119.

fixFix Agent Builder requests to Google Vertex AI inference endpoints failing when tool schemas include JSON Schema fields that Vertex doesn't accept #284810.

fixFix Agent Builder conversations failing when a prompt contains special tokens such as <|endoftext|>, or when Claude models receive empty text blocks #283177.

fixRestore legacy root-level inputs in Agent Builder workflow tool schemas so existing workflow tools keep working #285149.

fixFix concurrent conversations silently dropping a round when two clients replied at the same time. Case attachment requests that now conflict return HTTP 409 instead of appearing to succeed #281887.

fixFix agent custom instructions failing to save because the full edit payload was sent, which broke access control entries #277176.

fixFix visualizations generated from a specified index silently returning an empty chart when the query read from a different source. Agent Builder now retries once and then reports an error #282212.

fixFix the custom answer text field losing focus after you select its radio button when an agent asks a clarifying question #283326.

fixFix Cases free-text search failing when a case's extended fields produced too many runtime-field values #284475.

fixFix case Activity recording a row for every unchanged template or global field default when you create a case #284310.

fixFix assigning users to a case creating duplicate activity entries #284035.

fixFix field library toggle filters missing from More filters on the All cases page #283645.

fixFix duplicate required-on-close validation errors when a template references a global field that is also required on close #283922.

fixFix a template $ref field silently dropping its local display and validation overrides #283072.

fixPrevent changing a field definition's name or type after creation, which previously orphaned stored case values #282770.

fixResolve case field-definition references without regard to capitalization so renaming a field's casing no longer hides it from templates #282450.

fixFix global case field defaults not being applied to cases created through the API or workflow steps, and prevent the field-migration backfill from overwriting values you've already set or cleared #283185.

fixFix the case details Associated Users and Associated Hosts counts omitting directly attached user and host entities #283036.

fixFix the Alerting V2 update API rejecting a valid change of a signal rule's query format to composed #283754.

fixFix Lens metric trendline breakdown ordering to rank by the trendline's own metric instead of falling back to alphabetical order #283159.

fixFix histogram granularity to preserve the saved bar count instead of resetting to Auto above 7 bars. The effective ceiling remains the histogram:maxBars advanced setting #283058.

fixFix duration format to preserve decimal and compact settings on round-trip, except when using the automatic (auto-approximate) duration format #282815.

fixFix the dashboards list endpoint not sorting by last updated date in descending order when no search query is set #282363.

fixFix deleting a package policy from an agent policy with many agents blocking on a full synchronous redeploy instead of deploying asynchronously #282580.

fixFix Fleet bulk upgrades installing the bundled package version instead of the latest registry version #282829.

fixFix Fleet lookups that treated version-specific policy IDs as base policy IDs, which could return HTTP 404 for Fleet Server policy revisions and miss agents #283071.

+12 more items in the release notes

9.5.1 Aug 11, 2026 Release notes ↗

featureAdd limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.

featureStore assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.

featureAdd an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.

featureAdd transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.

fixFix Agent Builder retrying indefinitely on repeated empty responses from Anthropic models, which could exhaust the conversation before surfacing an error #281616.

fixFix Anthropic chat completion requests unexpectedly setting temperature: 0 when no temperature was configured, which could cause errors for Agent Builder and Attack Discovery #281179.

fixFix the attachment input pill border color in Agent Builder chat #282279.

fixFix ES|QL truncating the Tool Success Rate panel in the Agent Builder overview dashboard to 0% whenever there was at least one failure #282026.

fixFix the all cases list and case activity log to render user-picker, toggle, and checkbox field values correctly, and hide markdown-only fields from the column picker #282870.

fixFix duplicate activity entries when setting legacy custom fields #282813.

fixFix the all cases table column selector and template activity log to read from global fields after migrating to case templates #282129.

fixFix duplicate field-definition records being created when a legacy custom field is edited multiple times #282060.

fixFix the case list metrics bar to reflect the current search, filters, and date range instead of showing unfiltered totals #280576.

fixPrevent deleting a field definition that is still referenced by an active case template #280493.

fixFix the timestamp field in the alerting rule query sandbox not updating after the first selection #281854.

fixFix bulk-disabling alerting rules leaving their background execution tasks running after the rule shows as disabled #281468.

fixFix terms formatting to preserve multi-field grouping and column format on round-trip #282760.

fixFix terms include and exclude values to preserve numbers instead of converting them to strings #282752.

fixFix a Lens panel failing to load after duplicating it and then modifying its ad hoc data view, caused by colliding data view IDs #281786.

fixFix a Visualizations API error when reading back an XY chart with an annotation layer backed by an ad hoc data view #281079.

fixFix the Visualizations API dropping the custom name of an ad hoc, form-based data view on round-trip #280546.

fixFix Metric chart values colored by a value outside the configured range to use the default text color instead of blending into the background #280816.

fixDisable Fast mode for Basic and Platinum licenses; approximate results in Discover and Dashboards require an Enterprise license #279903.

fixFix the dashboards listing page failing to load when the savedObjects:listingLimit advanced setting exceeds 1,000 #282100.

fixIncrease the maximum number of hosts allowed on Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs from 10 to 100 #282397.

fixRemove the proxy configuration option from Kafka outputs, which never supported it #282313.

fixFix a layout flash and unexpected switch to the Fleet app when you select Add integration from the Integrations app #281493.

fixFix enrollment API keys ignoring the requested expiration so tokens never expired regardless of the value you set #281324.

fixFix Fleet-managed OpenTelemetry metrics data streams to use time series index mode by default for integration packages #281295.

fixFix managed OTLP API keys being created without the required APM privileges, which caused the managed OTLP endpoint to reject events #281261.

fixFix the agent policy filter on the agents list page to match agents assigned to version-specific policies #281195.

fixFix Fleet Server detection to recognize agents assigned to version-specific Fleet Server policies, which could leave the onboarding screen showing indefinitely #281092.

fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.

fixFix the agent policy download endpoint returning an HTTP 500 error for policies that reuse the same permissions object in more than one place #280669.

fixFix ILM Explain data not returning results for hidden and system indices in Index Management #282137.

fixFix the Short Dots transform dropping single-character path segments, for example rendering a.b.c as a.c #281930.

fixAlign the null-value label for server-side date fields with the client so CSV exports and the UI both show (null) #281367.

fixFix the Date Nanos formatter ignoring the configured date format for numeric values, such as aggregation results #281343.

fixFix Geo point degrees-minutes-seconds output rounding near-zero coordinates up to a full degree #281336.

fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, this applies only to reports created or re-saved after upgrading; existing schedules keep their previous behavior until recreated #278305.

+8 more items in the release notes

9.5.0 Aug 4, 2026 Release notes ↗

featureCreate skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.

featureEnable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.

featureShare private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.

featureAdd an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.

featureEnable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.

featureAdd install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643.

featureSet a resizable custom width for Agent Builder attachment canvas flyouts in full-screen view and overlay mode in the sidebar #265200.

featureAdd optional connector_ids to the Agent Builder conversation API to limit which connectors a request can use #267333.

featureShow permitted system indices and aliases in Agent Builder index selection, including alerts, ML anomaly results, SLOs, the entity store, exception lists, SIEM signals, and Stack Monitoring #265819.

featureRun several Agent Builder conversations at the same time, and track each conversation's status in the chats panel with In progress, Awaiting your input, Unread, and Error indicators #267980 #271689.

featureRoute low-effort Agent Builder operations such as ES|QL generation and conversation title generation to a configurable fast model, set per feature in Feature settings, with automatic fallback to the default model #265520 #274849 #275607.

featureEnable Cases as Data by default so you can analyze cases, activity, and attachments through dedicated indices and a prebuilt Case Analytics data view that stays current as custom fields change without replacing the space's default data view #279831 #280001.

featureEnable the redesigned Cases list, details, and settings pages by default #279367.

featureSnooze and unsnooze individual alerts with optional expiry or auto-unsnooze conditions #264090.

featureAdd a Stack Alerts feature privilege so roles can read and act on alerts without rule management access #273804.

featureAdd an Inspect action to view and run the Elasticsearch query used by custom threshold rules from the rule details page #262354.

featureMove the unified Rules page into Stack Management so navigation context remains visible #269568.

featureSearch, summarize, and update cases from Agent Builder chat with a cases skill, tools, and case attachments #271438.

featureAdd Add to chat and Summarize case actions to the case details page #276635 #279105.

featureAttach Lens visualizations to cases from Attach saved object #274959 #277040.

featureAttach Discover sessions, dashboards, and maps to cases #272423.

featureRedesign case attachments with a unified Attachments tab, collapsible sections and item counts by type, Type and Author filters, Refresh, and an Attach action on the Activity and Attachments tabs #270518 #272759 #269560.

featureAdd a warning when a selected file already exists in a case #279327.

featureExtract case observables automatically when alerts are added through the API, workflows, or Agent Builder #273455.

featureImprove case templates with toggle fields, unique template names, and a simplified default starter template #277626.

featureSplit the case template editor into Fields and Configuration tabs #277269.

featureAdd autocomplete and inline validation to the case template YAML editor #279346.

featureSet default connectors and case settings in case templates #275690.

featureAdd a display-only Markdown field type to case templates #278329.

featureAdd public Cases APIs to discover applicable extended_fields and apply template defaults when creating a case #279684 #280143.

featureAdd xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control Elasticsearch index.mapping.total_fields.limit on .alerts-* indices and templates #274024.

featureAdd a OneDrive connector to search files, browse drives, and read file content in Agent Builder and Workflows #275244.

featureAdd a Box connector to search files and folders and read file content in Agent Builder and Workflows #271306.

featureAdd an Outlook connector to search and browse email messages and download attachments in Agent Builder and Workflows #266766.

featureAdd a Snowflake connector to run SQL queries, explore databases and tables, and search with Cortex Search in Agent Builder and Workflows #264827.

featureAdd an Azure Blob Storage connector to list containers and blobs, read blob content, and search storage in Agent Builder and Workflows #259439.

featureAdd a HubSpot connector to search and retrieve contacts, companies, deals, tickets, and engagements in Agent Builder and Workflows #257675.

featureAdd a Sublime Security connector to investigate and act on email threats in Agent Builder and Workflows #279707.

featureAdd a Filter by feature control to the create-connector flyout, and show the HTTP connector in standard connector lists #271686.

featureImprove authentication options for Agent Builder connectors by listing recommended methods first with a Recommended badge and hiding legacy options when you create new connectors #273410.

+374 more items in the release notes

9.4.9 Nov 2, 2026 Release notes ↗