Kibana 8.6.0 → 8.19.11

77 releases · 0 breaking changes · 48 security fixes · 37 advisories fixed

48security0breaking0deprecated0feature0fix

Is 8.6.0 affected? · What changed up to 9.5.6

Vulnerabilities fixed by this upgrade

4.2 CVE-2026-78581 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain…
8.0 CVE-2026-49091 Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written…
4.4 CVE-2026-49088 Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi…
6.5 CVE-2026-26937 Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
4.9 CVE-2026-26936 Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
6.5 CVE-2026-0543 Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…
6.5 CVE-2026-0528 Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…
6.5 CVE-2026-0530 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…
6.5 CVE-2026-0531 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…
7.2 CVE-2025-68385 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…
4.3 CVE-2025-68386 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…
6.1 CVE-2025-68387 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…
6.5 CVE-2025-68389 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…
4.3 CVE-2025-68422 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…
5.4 CVE-2025-37732 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…
8.7 CVE-2025-25018 Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
8.2 CVE-2025-25017 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
8.7 CVE-2025-25009 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
4.3 CVE-2025-25012 URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
7.6 CVE-2024-43706 Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
9.1 CVE-2025-25014 A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
4.3 CVE-2025-25016 Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
5.4 CVE-2024-11390 Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc…
6.5 CVE-2024-52974 An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi…
6.5 CVE-2024-43708 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with…
6.5 CVE-2024-52972 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce…
6.5 CVE-2024-52973 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a…
9.1 CVE-2024-37287 A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot…
6.5 CVE-2024-37281 An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
4.9 CVE-2024-23443 A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.
6.1 CVE-2024-23442 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
6.5 CVE-2024-23446 An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s…
8.0 CVE-2023-46675 An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has…
8.0 CVE-2023-46671 An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error mes…
8.8 CVE-2023-31414 Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to exe…
6.1 CVE-2022-38779 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
6.5 CVE-2022-38778 A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 8.19.11
security Fixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). in 8.19.11
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 8.19.10
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 8.19.10
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 8.19.10
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 8.19.9
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 8.19.9
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 8.19.9
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 8.19.8
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 8.19.8
security Fixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This… in 8.19.7
security Fixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. in 8.19.7
security Fixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… in 8.19.6
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 8.19.5
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 8.19.5
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 8.19.4
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 8.19.0
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 8.18.8
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 8.18.8
security Fixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) in 8.18.8
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 8.18.3
security Fixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. in 8.17.8
security Fixes CVE-2025-25014: A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. in 8.17.6
security Fixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u… in 8.17.3
security Fixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. in 8.17.2
security Fixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… in 8.17.2
security Fixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u… in 8.16.6
security Fixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. in 8.16.4
security Fixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… in 8.16.3
security Fixes CVE-2024-52974: An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi… in 8.15.1
security Fixes CVE-2024-43707: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on t… in 8.15.0
security Fixes CVE-2024-43708: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with… in 8.15.0
security Fixes CVE-2024-52972: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce… in 8.15.0
security Fixes CVE-2024-43710: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying… in 8.15.0
security Fixes CVE-2024-37287: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot… in 8.14.2
security Fixes CVE-2024-52973: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a… in 8.14.2
security Fixes CVE-2024-37281: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint. in 8.14.0
security Fixes CVE-2024-23442: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 8.14.0
security Fixes CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. in 8.14.0
security Fixes CVE-2024-37279: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alertin… in 8.14.0
security Fixes CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. in 8.13.0
security Fixes CVE-2024-23446: An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s… in 8.12.1
security Fixes CVE-2024-11390: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc… in 8.12.0
security Fixes CVE-2023-46675: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has… in 8.11.2
security Fixes CVE-2026-49091: Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written… in 8.11.1
security Fixes CVE-2023-46671: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error mes… in 8.11.1
security Fixes CVE-2022-38779: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. in 8.6.2
security Fixes CVE-2022-38778: A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. in 8.6.1

Every release in between

8.19.11 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

securityFixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

8.19.10 Jan 13, 2026 Release notes ↗

securityFixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…

securityFixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…

securityFixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…

8.19.9 Dec 19, 2025 Release notes ↗

securityFixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…

securityFixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…

securityFixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…

8.19.8 Dec 2, 2025 Release notes ↗

securityFixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…

securityFixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…

8.19.7 Nov 11, 2025 Release notes ↗

securityFixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…

securityFixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

8.19.6 Oct 23, 2025 Release notes ↗

securityFixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi…

8.19.5 Oct 6, 2025 Release notes ↗

securityFixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

securityFixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

8.19.4 Sep 18, 2025 Release notes ↗

securityFixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

8.19.3 Aug 28, 2025 Release notes ↗

8.19.2 Aug 12, 2025 Release notes ↗

8.19.1 Aug 7, 2025 Release notes ↗

8.19.0 Jul 29, 2025 Release notes ↗

securityFixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…

8.18.8 Oct 6, 2025 Release notes ↗

securityFixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

securityFixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

securityFixes CVE-2025-25017: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

8.18.7 Sep 16, 2025 Release notes ↗

8.18.6 Aug 28, 2025 Release notes ↗

8.18.5 Aug 12, 2025 Release notes ↗

8.18.4 Jul 22, 2025 Release notes ↗

8.18.3 Jun 24, 2025 Release notes ↗

securityFixes CVE-2025-25012: URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.

8.18.2 May 29, 2025 Release notes ↗

8.18.1 May 6, 2025 Release notes ↗

8.18.0 Apr 15, 2025 Release notes ↗

8.17.10 Aug 12, 2025 Release notes ↗

8.17.9 Jul 22, 2025 Release notes ↗

8.17.8 Jun 24, 2025 Release notes ↗

8.17.7 Jun 3, 2025 Release notes ↗

8.17.6 May 6, 2025 Release notes ↗

securityFixes CVE-2025-25014: A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

8.17.5 Apr 15, 2025 Release notes ↗

8.17.4 Mar 25, 2025 Release notes ↗

8.17.3 Mar 4, 2025 Release notes ↗

securityFixes CVE-2025-25015: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by u…

8.17.2 Feb 11, 2025 Release notes ↗

securityFixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

securityFixes CVE-2026-78581: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain…

8.17.1 Jan 21, 2025 Release notes ↗

8.17.0 Dec 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.17/release-notes-8.17.0.html

8.16.6 Mar 25, 2025 Release notes ↗

8.16.5 Mar 4, 2025 Release notes ↗

8.16.4 Feb 11, 2025 Release notes ↗

securityFixes CVE-2024-12556: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.

8.16.3 Jan 21, 2025 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.3.html

8.16.2 Dec 17, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.2.html

8.16.1 Nov 22, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.1.html

8.16.0 Nov 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.16/release-notes-8.16.0.html

8.15.5 Nov 26, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.5.html

8.15.4 Nov 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.4.html

8.15.3 Oct 17, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.3.html

8.15.2 Sep 26, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.2.html

8.15.1 Sep 5, 2024 Release notes ↗

securityFixes CVE-2024-52974: An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.1.html

8.15.0 Aug 8, 2024 Release notes ↗

securityFixes CVE-2024-43707: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on t…

securityFixes CVE-2024-43708: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with…

securityFixes CVE-2024-52972: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce…

securityFixes CVE-2024-43710: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.15/release-notes-8.15.0.html

8.14.3 Jul 11, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.14/release-notes-8.14.3.html

8.14.2 Jul 4, 2024 Release notes ↗

securityFixes CVE-2024-37287: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot…

securityFixes CVE-2024-52973: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.14/release-notes-8.14.2.html

8.14.1 Jun 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/main/release-notes-8.14.1.html

8.14.0 Jun 5, 2024 Release notes ↗

securityFixes CVE-2024-37281: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.

securityFixes CVE-2024-23442: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

securityFixes CVE-2024-23443: A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

securityFixes CVE-2024-37279: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alertin…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.14/release-notes-8.14.0.html

8.13.4 May 14, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.4.html

8.13.3 May 3, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.3.html

8.13.2 Apr 8, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.2.html

8.13.1 Apr 2, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.1.html

8.13.0 Mar 26, 2024 Release notes ↗

securityFixes CVE-2025-25016: Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.13/release-notes-8.13.0.html

8.12.2 Feb 22, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.12/release-notes-8.12.2.html

8.12.1 Feb 6, 2024 Release notes ↗

securityFixes CVE-2024-23446: An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.12/release-notes-8.12.1.html

8.12.0 Jan 17, 2024 Release notes ↗

securityFixes CVE-2024-11390: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have acc…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.12/release-notes-8.12.0.html

8.11.4 Jan 11, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.4.html

8.11.3 Dec 12, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.3.html

8.11.2 Dec 7, 2023 Release notes ↗

securityFixes CVE-2023-46675: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.2.html

8.11.1 Nov 13, 2023 Release notes ↗

securityFixes CVE-2026-49091: Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written…

securityFixes CVE-2023-46671: An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error mes…

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.1.html

8.11.0 Nov 7, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.0.html

8.10.4 Oct 17, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.10/release-notes-8.10.4.html

8.10.3 Oct 10, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.10/release-notes-8.10.3.html

8.10.2 Sep 21, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.10/release-notes-8.10.2.html

8.10.1 Sep 18, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.10/release-notes-8.10.1.html

8.10.0 Sep 12, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.10/release-notes-8.10.0.html

8.9.2 Sep 6, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.9/release-notes-8.9.2.html

8.9.1 Aug 17, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.9/release-notes-8.9.1.html

8.9.0 Jul 25, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.9/release-notes-8.9.0.html

8.8.2 Jun 29, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.8/release-notes-8.8.2.html

8.8.1 Jun 8, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.8/release-notes-8.8.1.html

8.8.0 May 25, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.8/release-notes-8.8.0.html

8.7.1 May 2, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.7/release-notes-8.7.1.html

8.7.0 Mar 30, 2023 Release notes ↗

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.7/release-notes-8.7.0.html

8.6.2 Feb 16, 2023 Release notes ↗

securityFixes CVE-2022-38779: An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.6/release-notes-8.6.2.html

8.6.1 Jan 26, 2023 Release notes ↗

securityFixes CVE-2022-38778: A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.

otherDownloads: https://elastic.co/downloads/kibana Release notes: https://www.elastic.co/guide/en/kibana/8.6/release-notes-8.6.1.html