Kibana 8.11.3 → 8.19.14

61 releases · 0 breaking changes · 51 security fixes · 41 advisories fixed

51security0breaking0deprecated0feature0fix

Is 8.11.3 affected? · What changed up to 9.5.6

Vulnerabilities fixed by this upgrade

4.2 CVE-2026-78581 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain…
4.4 CVE-2026-49088 Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi…
7.7 CVE-2026-4498 Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…
7.7 CVE-2026-33461 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…
4.3 CVE-2026-33460 Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…
6.5 CVE-2026-26939 Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s…
6.5 CVE-2026-26940 Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…
6.5 CVE-2026-26937 Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
6.5 CVE-2026-26935 Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
4.9 CVE-2026-26936 Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
6.5 CVE-2026-0543 Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…
6.5 CVE-2026-0528 Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…
6.5 CVE-2026-0530 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…
6.5 CVE-2026-0531 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…
7.2 CVE-2025-68385 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…
4.3 CVE-2025-68386 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…
6.1 CVE-2025-68387 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…
6.5 CVE-2025-68389 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…
4.3 CVE-2025-68422 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…
5.4 CVE-2025-37732 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…
8.7 CVE-2025-25018 Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
8.2 CVE-2025-25017 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
8.7 CVE-2025-25009 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
4.3 CVE-2025-25012 URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
7.6 CVE-2024-43706 Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
9.1 CVE-2025-25014 A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
4.3 CVE-2025-25016 Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
5.4 CVE-2024-11390 Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc…
6.5 CVE-2024-52974 An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi…
6.5 CVE-2024-43708 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with…
6.5 CVE-2024-52972 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce…
7.7 CVE-2024-43707 An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on t…
4.3 CVE-2024-43710 A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying…
6.5 CVE-2024-52973 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a…
9.1 CVE-2024-37285 A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to h…
9.1 CVE-2024-37287 A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot…
6.5 CVE-2024-37281 An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
4.9 CVE-2024-23443 A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.
6.1 CVE-2024-23442 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
4.3 CVE-2024-37279 A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alertin…
6.5 CVE-2024-23446 An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 8.19.14
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 8.19.14
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 8.19.14
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 8.19.14
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 8.19.13
security Fixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s… in 8.19.12
security Fixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC… in 8.19.12
security Fixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 8.19.12
security Fixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 8.19.11
security Fixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). in 8.19.11
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 8.19.10
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 8.19.10
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 8.19.10
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 8.19.9
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 8.19.9
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 8.19.9
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 8.19.8
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 8.19.8
security Fixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This… in 8.19.7
security Fixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. in 8.19.7
security Fixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… in 8.19.6
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 8.19.5
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 8.19.5
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 8.19.4
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 8.19.0
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 8.18.8
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 8.18.8
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 8.18.8
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 8.18.3
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 8.17.8
security Fixes CVE-2025-25014: A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. in 8.17.6
security Fixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u… in 8.17.3
security Fixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. in 8.17.2
security Fixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… in 8.17.2
security Fixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u… in 8.16.6
security Fixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. in 8.16.4
security Fixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… in 8.16.3
security Fixes CVE-2024-52974: An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi… in 8.15.1
security Fixes CVE-2024-43707: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on t… in 8.15.0
security Fixes CVE-2024-43708: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with… in 8.15.0
security Fixes CVE-2024-52972: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce… in 8.15.0
security Fixes CVE-2024-43710: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying… in 8.15.0
security Fixes CVE-2024-37287: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot… in 8.14.2
security Fixes CVE-2024-52973: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a… in 8.14.2
security Fixes CVE-2024-37281: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint. in 8.14.0
security Fixes CVE-2024-23442: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 8.14.0
security Fixes CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. in 8.14.0
security Fixes CVE-2024-37279: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alertin… in 8.14.0
security Fixes CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. in 8.13.0
security Fixes CVE-2024-23446: An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s… in 8.12.1
security Fixes CVE-2024-11390: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc… in 8.12.0

Every release in between

8.19.14 Apr 8, 2026 Release notes ↗

securityFixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…

securityFixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…

securityFixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…

securityFixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…

8.19.13 Mar 19, 2026 Release notes ↗

securityFixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…

8.19.12 Feb 26, 2026 Release notes ↗

securityFixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s…

securityFixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC…

securityFixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

8.19.11 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

securityFixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

8.19.10 Jan 13, 2026 Release notes ↗

securityFixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…

securityFixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…

securityFixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…

8.19.9 Dec 19, 2025 Release notes ↗

securityFixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…

securityFixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…

securityFixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…

8.19.8 Dec 2, 2025 Release notes ↗

securityFixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…

securityFixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…

8.19.7 Nov 11, 2025 Release notes ↗

securityFixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…

securityFixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

8.19.6 Oct 23, 2025 Release notes ↗

securityFixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi…

8.19.5 Oct 6, 2025 Release notes ↗

securityFixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

securityFixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

8.19.4 Sep 18, 2025 Release notes ↗

securityFixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

8.19.3 Aug 28, 2025 Release notes ↗

8.19.2 Aug 12, 2025 Release notes ↗

8.19.1 Aug 7, 2025 Release notes ↗

8.19.0 Jul 29, 2025 Release notes ↗

securityFixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…

8.18.8 Oct 6, 2025 Release notes ↗

securityFixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

securityFixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

securityFixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

8.18.7 Sep 16, 2025 Release notes ↗

8.18.6 Aug 28, 2025 Release notes ↗

8.18.5 Aug 12, 2025 Release notes ↗

8.18.4 Jul 22, 2025 Release notes ↗

8.18.3 Jun 24, 2025 Release notes ↗

securityFixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

8.18.2 May 29, 2025 Release notes ↗

8.18.1 May 6, 2025 Release notes ↗

8.18.0 Apr 15, 2025 Release notes ↗

8.17.10 Aug 12, 2025 Release notes ↗

8.17.9 Jul 22, 2025 Release notes ↗

8.17.8 Jun 24, 2025 Release notes ↗

8.17.7 Jun 3, 2025 Release notes ↗

8.17.6 May 6, 2025 Release notes ↗

securityFixes CVE-2025-25014: A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

8.17.5 Apr 15, 2025 Release notes ↗

8.17.4 Mar 25, 2025 Release notes ↗

8.17.3 Mar 4, 2025 Release notes ↗

securityFixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u…

8.17.2 Feb 11, 2025 Release notes ↗

securityFixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

securityFixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain…

8.17.1 Jan 21, 2025 Release notes ↗

8.17.0 Dec 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.17/release-notes-8.17.0.html

8.16.6 Mar 25, 2025 Release notes ↗

8.16.5 Mar 4, 2025 Release notes ↗

8.16.4 Feb 11, 2025 Release notes ↗

securityFixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

8.16.3 Jan 21, 2025 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.3.html

8.16.2 Dec 17, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.2.html

8.16.1 Nov 22, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.1.html

8.16.0 Nov 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.0.html

8.15.5 Nov 26, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.5.html

8.15.4 Nov 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.4.html

8.15.3 Oct 17, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.3.html

8.15.2 Sep 26, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.2.html

8.15.1 Sep 5, 2024 Release notes ↗

securityFixes CVE-2024-52974: An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.1.html

8.15.0 Aug 8, 2024 Release notes ↗

securityFixes CVE-2024-43707: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on t…

securityFixes CVE-2024-43708: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with…

securityFixes CVE-2024-52972: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce…

securityFixes CVE-2024-43710: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.0.html

8.14.3 Jul 11, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.14/release-notes-8.14.3.html

8.14.2 Jul 4, 2024 Release notes ↗

securityFixes CVE-2024-37287: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot…

securityFixes CVE-2024-52973: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.14/release-notes-8.14.2.html

8.14.1 Jun 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/main/release-notes-8.14.1.html

8.14.0 Jun 5, 2024 Release notes ↗

securityFixes CVE-2024-37281: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.

securityFixes CVE-2024-23442: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

securityFixes CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

securityFixes CVE-2024-37279: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alertin…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.14/release-notes-8.14.0.html

8.13.4 May 14, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.4.html

8.13.3 May 3, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.3.html

8.13.2 Apr 8, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.2.html

8.13.1 Apr 2, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.1.html

8.13.0 Mar 26, 2024 Release notes ↗

securityFixes CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.0.html

8.12.2 Feb 22, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.12/release-notes-8.12.2.html

8.12.1 Feb 6, 2024 Release notes ↗

securityFixes CVE-2024-23446: An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.12/release-notes-8.12.1.html

8.12.0 Jan 17, 2024 Release notes ↗

securityFixes CVE-2024-11390: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.12/release-notes-8.12.0.html

8.11.4 Jan 11, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.4.html