Kibana 9.1.4 → 9.5.3

38 releases · 0 breaking changes · 152 security fixes · 82 advisories fixed

152security0breaking0deprecated204feature648fix

Is 9.1.4 affected? · What changed up to 9.5.6

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
8.1 CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…
6.5 CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…
6.5 CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…
7.3 CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…
6.3 CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…
5.4 CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…
6.5 CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…
7.3 CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…
4.3 CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica…
4.3 CVE-2026-78603 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal…
6.5 CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…
6.5 CVE-2026-72628 Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…
4.3 CVE-2026-72633 Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
6.5 CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…
6.5 CVE-2026-33465 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could…
7.1 CVE-2026-72675 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its…
6.5 CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i…
7.3 CVE-2026-72677 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…
8.1 CVE-2026-72665 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by…
6.8 CVE-2026-72666 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a…
6.5 CVE-2026-72667 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica…
7.6 CVE-2026-72669 The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic…
7.7 CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…
4.3 CVE-2026-72671 A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…
7.7 CVE-2026-72672 The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins…
5.4 CVE-2026-72673 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv…
7.3 CVE-2026-72658 Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf…
6.5 CVE-2026-72659 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki…
6.5 CVE-2026-72660 Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…
6.5 CVE-2026-72661 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…
6.5 CVE-2026-72663 Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV…
6.5 CVE-2026-72664 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…
4.3 CVE-2026-72650 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
6.5 CVE-2026-72651 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a…
6.5 CVE-2026-72653 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…
4.3 CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of…
7.1 CVE-2026-72632 Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r…
7.1 CVE-2026-72629 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i…
7.1 CVE-2026-72630 Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in…
6.5 CVE-2026-72631 Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t…
6.5 CVE-2026-49089 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope…
4.3 CVE-2026-49096 Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…
5.0 CVE-2026-63142 Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…
4.3 CVE-2026-63143 Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…
4.3 CVE-2026-63145 Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…
6.5 CVE-2026-63260 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…
6.5 CVE-2026-63261 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…
6.5 CVE-2026-56151 Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…
6.5 CVE-2026-49087 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…
4.4 CVE-2026-49088 Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi…
6.5 CVE-2026-49095 Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…
7.7 CVE-2026-42398 Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn…
6.5 CVE-2026-42399 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…
6.5 CVE-2026-42400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…
6.5 CVE-2026-33464 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…
4.1 CVE-2026-42401 Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…
4.6 CVE-2026-33462 A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…
5.3 CVE-2026-33463 Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…
6.5 CVE-2026-33459 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…
7.7 CVE-2026-4498 Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…
7.7 CVE-2026-33461 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…
4.3 CVE-2026-33460 Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…
6.5 CVE-2026-26939 Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s…
6.5 CVE-2026-26940 Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…
6.5 CVE-2026-26937 Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
6.5 CVE-2026-26934 Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC…
6.5 CVE-2026-26935 Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
4.9 CVE-2026-26936 Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
6.5 CVE-2026-0543 Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…
6.5 CVE-2026-0528 Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…
6.5 CVE-2026-0530 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…
6.5 CVE-2026-0531 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…
7.2 CVE-2025-68385 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…
4.3 CVE-2025-68386 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…
6.1 CVE-2025-68387 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…
6.5 CVE-2025-68389 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…
4.3 CVE-2025-68422 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…
5.4 CVE-2025-37732 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…
4.3 CVE-2025-37734 Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
8.7 CVE-2025-25018 Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
8.7 CVE-2025-25009 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.5.3
security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.3
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.5.2
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.5.2
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.5.2
security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.5.2
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.5.2
security Fixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li… in 9.4.8
security Fixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… in 9.4.7
security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 9.4.7
security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.4.6
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.4.6
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.4.6
security Fixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age… in 9.4.6
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.4.6
security Fixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only… in 9.4.6
security Fixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… in 9.4.6
security Fixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal… in 9.4.6
security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.6
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.4.6
security Fixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by… in 9.4.5
security Fixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… in 9.4.5
security Fixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins… in 9.4.5
security Fixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic… in 9.4.5
security Fixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… in 9.4.5
security Fixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… in 9.4.5
security Fixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r… in 9.4.5
security Fixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A… in 9.4.5
security Fixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i… in 9.4.5
security Fixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in… in 9.4.5
security Fixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a… in 9.4.5
security Fixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use… in 9.4.5
security Fixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe… in 9.4.5
security Fixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i… in 9.4.5
security Fixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a… in 9.4.5
security Fixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… in 9.4.5
security Fixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… in 9.4.5
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.4.5
security Fixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… in 9.4.5
security Fixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… in 9.4.5
security Fixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… in 9.4.5
security Fixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t… in 9.4.5
security Fixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… in 9.4.5
security Fixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati… in 9.4.5
security Fixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… in 9.4.5
security Fixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.5
security Fixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… in 9.4.5
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.4.4
security Fixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func… in 9.4.4
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.4.4
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.4.4
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.4.4
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.4.4
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.4.4
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.4.4
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.4.4
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.4.4
security Fixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… in 9.4.4
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.4.4
security Fixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu… in 9.4.4
security Fixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. in 9.4.4
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.4.4
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.4.4
security Fixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t… in 9.4.4
security Fixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio… in 9.4.3
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.4.3
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.4.3
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.4.3
security Fixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… in 9.4.3
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.4.3
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.4.3
security Fixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us… in 9.4.3
security Fixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under… in 9.4.3
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.4.2
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.4.2
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.4.2
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.4.2
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.4.2
security Fixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper… in 9.4.0
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.3.8
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.3.8
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.3.8
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.3.8
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.3.8
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.3.8
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.3.8
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.3.8
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.3.8
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.3.8
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.3.8
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.3.8
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.3.7
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.7
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.3.6
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.3.6
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.3.6
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.3.6
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.3.5
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.3.5
security Fixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.5
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.3.5
security Fixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… in 9.3.5
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.3.5
security Fixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… in 9.3.5
security Fixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… in 9.3.5
security Fixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… in 9.3.5
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.3.5
security Fixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… in 9.3.5
security Fixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… in 9.3.4
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.3.3
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.3.3
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.3.3
security Fixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server… in 9.3.3
security Fixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest… in 9.3.3
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.3.3
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.3.2
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.3.2
security Fixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could… in 9.3.0
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.2.8
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.2.8
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.2.8
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.2.8
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.2.8
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.2.7
security Fixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s… in 9.2.6
security Fixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC… in 9.2.6
security Fixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 9.2.6
security Fixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 9.2.5
security Fixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). in 9.2.5
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 9.2.4
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 9.2.4
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 9.2.4
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 9.2.4
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 9.2.3
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 9.2.3
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 9.2.3
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 9.2.2
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 9.2.2
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 9.1.10
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 9.1.10
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 9.1.10
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 9.1.10
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 9.1.9
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 9.1.9
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 9.1.9
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 9.1.8
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 9.1.8
security Fixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This… in 9.1.7
security Fixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. in 9.1.7
security Fixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… in 9.1.6
security Fixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) in 9.1.5
security Fixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. in 9.1.5

Every release in between

9.5.3 Sep 3, 2026 Release notes ↗

securityFixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…

securityFixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

featureWarn in the field library and template editors when a required case field has no default value, because automated case creation can't fill it in, and show a field's name and type as permanent as soon as you create it #285453.

featureEnforce required global fields on API and workflow case creation when case templates are enabled, and accept extended_fields on the public and workflow case create and update APIs #283350.

featureRaise the Dev Tools Console Copy to curl limit so a request-body string of up to 100000 characters copies successfully #287526.

fixFix the research agent re-asking clarifying questions you already answered in the same round #284800.

fixFix disabled pre-execution workflows disappearing from Agent Builder settings so you cannot remove them. A disabled workflow stays visible and is labeled (disabled) #286826.

fixFix legacy custom fields and their v2 field-definition counterparts falling out of sync, by linking each legacy field to its definition and keeping both representations equal on every write #282772.

fixFix cases created from a case template by a rule action not inheriting the template's external connector, Sync alerts and Extract observables settings, and assignees #284854.

fixFix matching fields missing from Cases Activity search results #284940.

fixFix case attachment UI issues, including delete controls on saved-object attachments and the more-actions menu for read-only access #285456.

fixFix saved Lens visualizations missing from case attachments, and add helper text in the markdown editor for inline Timeline and Lens references #286164.

fixFix creating a case from a workflow, a case template, or machine learning so Sync alerts is not turned on unless that solution enables it #286670.

fixFix the Additional fields editor on the ServiceNow ITSM, ServiceNow SecOps, and Jira connectors rejecting Mustache context variables as invalid JSON #286578.

fixFix required-on-close validation skipping global fields that a template includes by $ref #287306.

fixFix a template $ref global field ignoring its hide-on-value condition when the controlling field is in another section #287308.

fixFix global field column selections not syncing between the Cases list and table views #287327.

fixFix the Cases list keeping the previous page after you change filters #287945.

fixFix custom threshold no data alerts firing for groups that belong to a different custom threshold rule #287151.

fixFix custom threshold Rate aggregations not firing when a counter increases from 0 to a positive value #283973.

fixFix experimental alerting system .rule-events and .alert-actions data streams requesting a replica on single-node clusters, which left those shards unassigned #287544.

fixFix alerting resource installation using unbounded concurrency, which could exhaust Kibana heap when many contexts and namespaces install at once #287643.

fixFix by-reference visualization panels disappearing from dashboards when the panel's savedObjectRef reference is missing #285476.

fixFix metric chart background trendlines failing for ES|QL time-series queries that use TBUCKET(...) #284839.

fixFix the Maps timeslider close button registering clicks only on the top quarter of the control #287441.

fixFix Canvas functions API creating data tables with more than 50 columns per row #287935.

fixFix package policy inputs for newer agent versions not being backfilled after a Kibana minor upgrade #284710.

fixAvoid querying Elasticsearch for integration sync when no cross-cluster replication follower index exists #285526.

fixFix space awareness on Fleet agent tag, upload, file, and unenroll API handlers #284936.

fixFix Fleet wrapping a Kafka Dynamic topic multi-field format string such as %{[data_stream.type]}-%{[data_stream.namespace]}, which produced an invalid topic expression #285581.

fixFix Fleet package manifests accepting cluster privileges outside the documented allow list #286084.

fixFix Fleet agent CSV export failing when xpack.reporting.csv.scroll.strategy is scroll, or when Search in frozen indices is enabled #286119.

fixFix the Fleet agent-status-change task failing when the Elasticsearch response is too large #286324.

fixFix sorting the Agents table by Host so it uses the hostname keyword field instead of the analyzed text field #286383.

fixFix package policies accepting a whitespace-only namespace, which saved while ingestion failed silently #286385.

fixFix the CPU and memory tooltip on offline agents showing misleading messages instead of clearly stating the agent is offline #286386.

fixFix managed integration throughput index patterns for streams that use a dynamic dataset #286758.

fixFix update and delete of legacy managed integration policies returning HTTP 404 or reporting success while the deployment kept running #287011.

fixFix stale version-specific Fleet policies remaining after their agent version dropped out of the bounded set, and refresh variants that still have enrolled agents #287095.

fixFix slow Fleet outputs fetching on Fleet setup and Integrations UI page load #287113.

+21 more items in the release notes

9.5.2 Aug 20, 2026 Release notes ↗

securityFixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…

securityFixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…

securityFixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…

securityFixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two…

featureAdd a public API to create, update, and delete case templates (POST, PUT, and DELETE /api/cases/templates), including a dry-run mode that validates a template without saving it #280144.

featureImprove the Cases view, cases list, and field library by keeping the case details panel in view as you scroll, saving status and other fields immediately when changed, and adding drag-and-drop field reordering to the field library #282197.

featureAdd an Agent Builder tool to attach saved dashboards, maps, Discover sessions, and Lens visualizations to a case #279680.

featureRestore Defer loading panels below "the fold" (labs:dashboard:deferBelowFold) so off-screen dashboard panels wait to fetch data until they scroll into view. The setting is off by default #284004.

featureAdd a toggle to the Manage region preferences modal so you can remove a custom region policy and revert to allowing all regions #282769.

featureAdd step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.

featureEnable running a workflow with only the execute privilege, without also requiring the read privilege on the workflow definition #284822.

fixFix missing screen reader announcements when toggling the Show active only filter on the agent tools page #282276.

fixFix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when you configure cross-cluster search index patterns but the cluster doesn't have the remote cluster client role #281609.

fixFix chat completion streams continuing after you cancel a request, and cap their duration at 10 minutes #285119.

fixFix Agent Builder requests to Google Vertex AI inference endpoints failing when tool schemas include JSON Schema fields that Vertex doesn't accept #284810.

fixFix Agent Builder conversations failing when a prompt contains special tokens such as <|endoftext|>, or when Claude models receive empty text blocks #283177.

fixRestore legacy root-level inputs in Agent Builder workflow tool schemas so existing workflow tools keep working #285149.

fixFix concurrent conversations silently dropping a round when two clients replied at the same time. Case attachment requests that now conflict return HTTP 409 instead of appearing to succeed #281887.

fixFix agent custom instructions failing to save because the full edit payload was sent, which broke access control entries #277176.

fixFix visualizations generated from a specified index silently returning an empty chart when the query read from a different source. Agent Builder now retries once and then reports an error #282212.

fixFix the custom answer text field losing focus after you select its radio button when an agent asks a clarifying question #283326.

fixFix Cases free-text search failing when a case's extended fields produced too many runtime-field values #284475.

fixFix case Activity recording a row for every unchanged template or global field default when you create a case #284310.

fixFix assigning users to a case creating duplicate activity entries #284035.

fixFix field library toggle filters missing from More filters on the All cases page #283645.

fixFix duplicate required-on-close validation errors when a template references a global field that is also required on close #283922.

fixFix a template $ref field silently dropping its local display and validation overrides #283072.

fixPrevent changing a field definition's name or type after creation, which previously orphaned stored case values #282770.

fixResolve case field-definition references without regard to capitalization so renaming a field's casing no longer hides it from templates #282450.

fixFix global case field defaults not being applied to cases created through the API or workflow steps, and prevent the field-migration backfill from overwriting values you've already set or cleared #283185.

fixFix the case details Associated Users and Associated Hosts counts omitting directly attached user and host entities #283036.

fixFix the Alerting V2 update API rejecting a valid change of a signal rule's query format to composed #283754.

fixFix Lens metric trendline breakdown ordering to rank by the trendline's own metric instead of falling back to alphabetical order #283159.

fixFix histogram granularity to preserve the saved bar count instead of resetting to Auto above 7 bars. The effective ceiling remains the histogram:maxBars advanced setting #283058.

fixFix duration format to preserve decimal and compact settings on round-trip, except when using the automatic (auto-approximate) duration format #282815.

fixFix the dashboards list endpoint not sorting by last updated date in descending order when no search query is set #282363.

fixFix deleting a package policy from an agent policy with many agents blocking on a full synchronous redeploy instead of deploying asynchronously #282580.

fixFix Fleet bulk upgrades installing the bundled package version instead of the latest registry version #282829.

fixFix Fleet lookups that treated version-specific policy IDs as base policy IDs, which could return HTTP 404 for Fleet Server policy revisions and miss agents #283071.

+12 more items in the release notes

9.5.1 Aug 11, 2026 Release notes ↗

featureAdd limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.

featureStore assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.

featureAdd an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.

featureAdd transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.

fixFix Agent Builder retrying indefinitely on repeated empty responses from Anthropic models, which could exhaust the conversation before surfacing an error #281616.

fixFix Anthropic chat completion requests unexpectedly setting temperature: 0 when no temperature was configured, which could cause errors for Agent Builder and Attack Discovery #281179.

fixFix the attachment input pill border color in Agent Builder chat #282279.

fixFix ES|QL truncating the Tool Success Rate panel in the Agent Builder overview dashboard to 0% whenever there was at least one failure #282026.

fixFix the all cases list and case activity log to render user-picker, toggle, and checkbox field values correctly, and hide markdown-only fields from the column picker #282870.

fixFix duplicate activity entries when setting legacy custom fields #282813.

fixFix the all cases table column selector and template activity log to read from global fields after migrating to case templates #282129.

fixFix duplicate field-definition records being created when a legacy custom field is edited multiple times #282060.

fixFix the case list metrics bar to reflect the current search, filters, and date range instead of showing unfiltered totals #280576.

fixPrevent deleting a field definition that is still referenced by an active case template #280493.

fixFix the timestamp field in the alerting rule query sandbox not updating after the first selection #281854.

fixFix bulk-disabling alerting rules leaving their background execution tasks running after the rule shows as disabled #281468.

fixFix terms formatting to preserve multi-field grouping and column format on round-trip #282760.

fixFix terms include and exclude values to preserve numbers instead of converting them to strings #282752.

fixFix a Lens panel failing to load after duplicating it and then modifying its ad hoc data view, caused by colliding data view IDs #281786.

fixFix a Visualizations API error when reading back an XY chart with an annotation layer backed by an ad hoc data view #281079.

fixFix the Visualizations API dropping the custom name of an ad hoc, form-based data view on round-trip #280546.

fixFix Metric chart values colored by a value outside the configured range to use the default text color instead of blending into the background #280816.

fixDisable Fast mode for Basic and Platinum licenses; approximate results in Discover and Dashboards require an Enterprise license #279903.

fixFix the dashboards listing page failing to load when the savedObjects:listingLimit advanced setting exceeds 1,000 #282100.

fixIncrease the maximum number of hosts allowed on Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs from 10 to 100 #282397.

fixRemove the proxy configuration option from Kafka outputs, which never supported it #282313.

fixFix a layout flash and unexpected switch to the Fleet app when you select Add integration from the Integrations app #281493.

fixFix enrollment API keys ignoring the requested expiration so tokens never expired regardless of the value you set #281324.

fixFix Fleet-managed OpenTelemetry metrics data streams to use time series index mode by default for integration packages #281295.

fixFix managed OTLP API keys being created without the required APM privileges, which caused the managed OTLP endpoint to reject events #281261.

fixFix the agent policy filter on the agents list page to match agents assigned to version-specific policies #281195.

fixFix Fleet Server detection to recognize agents assigned to version-specific Fleet Server policies, which could leave the onboarding screen showing indefinitely #281092.

fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.

fixFix the agent policy download endpoint returning an HTTP 500 error for policies that reuse the same permissions object in more than one place #280669.

fixFix ILM Explain data not returning results for hidden and system indices in Index Management #282137.

fixFix the Short Dots transform dropping single-character path segments, for example rendering a.b.c as a.c #281930.

fixAlign the null-value label for server-side date fields with the client so CSV exports and the UI both show (null) #281367.

fixFix the Date Nanos formatter ignoring the configured date format for numeric values, such as aggregation results #281343.

fixFix Geo point degrees-minutes-seconds output rounding near-zero coordinates up to a full degree #281336.

fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, this applies only to reports created or re-saved after upgrading; existing schedules keep their previous behavior until recreated #278305.

+8 more items in the release notes

9.5.0 Aug 4, 2026 Release notes ↗

featureCreate skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.

featureEnable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.

featureShare private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.

featureAdd an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.

featureEnable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.

featureAdd install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643.

featureSet a resizable custom width for Agent Builder attachment canvas flyouts in full-screen view and overlay mode in the sidebar #265200.

featureAdd optional connector_ids to the Agent Builder conversation API to limit which connectors a request can use #267333.

featureShow permitted system indices and aliases in Agent Builder index selection, including alerts, ML anomaly results, SLOs, the entity store, exception lists, SIEM signals, and Stack Monitoring #265819.

featureRun several Agent Builder conversations at the same time, and track each conversation's status in the chats panel with In progress, Awaiting your input, Unread, and Error indicators #267980 #271689.

featureRoute low-effort Agent Builder operations such as ES|QL generation and conversation title generation to a configurable fast model, set per feature in Feature settings, with automatic fallback to the default model #265520 #274849 #275607.

featureEnable Cases as Data by default so you can analyze cases, activity, and attachments through dedicated indices and a prebuilt Case Analytics data view that stays current as custom fields change without replacing the space's default data view #279831 #280001.

featureEnable the redesigned Cases list, details, and settings pages by default #279367.

featureSnooze and unsnooze individual alerts with optional expiry or auto-unsnooze conditions #264090.

featureAdd a Stack Alerts feature privilege so roles can read and act on alerts without rule management access #273804.

featureAdd an Inspect action to view and run the Elasticsearch query used by custom threshold rules from the rule details page #262354.

featureMove the unified Rules page into Stack Management so navigation context remains visible #269568.

featureSearch, summarize, and update cases from Agent Builder chat with a cases skill, tools, and case attachments #271438.

featureAdd Add to chat and Summarize case actions to the case details page #276635 #279105.

featureAttach Lens visualizations to cases from Attach saved object #274959 #277040.

featureAttach Discover sessions, dashboards, and maps to cases #272423.

featureRedesign case attachments with a unified Attachments tab, collapsible sections and item counts by type, Type and Author filters, Refresh, and an Attach action on the Activity and Attachments tabs #270518 #272759 #269560.

featureAdd a warning when a selected file already exists in a case #279327.

featureExtract case observables automatically when alerts are added through the API, workflows, or Agent Builder #273455.

featureImprove case templates with toggle fields, unique template names, and a simplified default starter template #277626.

featureSplit the case template editor into Fields and Configuration tabs #277269.

featureAdd autocomplete and inline validation to the case template YAML editor #279346.

featureSet default connectors and case settings in case templates #275690.

featureAdd a display-only Markdown field type to case templates #278329.

featureAdd public Cases APIs to discover applicable extended_fields and apply template defaults when creating a case #279684 #280143.

featureAdd xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control Elasticsearch index.mapping.total_fields.limit on .alerts-* indices and templates #274024.

featureAdd a OneDrive connector to search files, browse drives, and read file content in Agent Builder and Workflows #275244.

featureAdd a Box connector to search files and folders and read file content in Agent Builder and Workflows #271306.

featureAdd an Outlook connector to search and browse email messages and download attachments in Agent Builder and Workflows #266766.

featureAdd a Snowflake connector to run SQL queries, explore databases and tables, and search with Cortex Search in Agent Builder and Workflows #264827.

featureAdd an Azure Blob Storage connector to list containers and blobs, read blob content, and search storage in Agent Builder and Workflows #259439.

featureAdd a HubSpot connector to search and retrieve contacts, companies, deals, tickets, and engagements in Agent Builder and Workflows #257675.

featureAdd a Sublime Security connector to investigate and act on email threats in Agent Builder and Workflows #279707.

featureAdd a Filter by feature control to the create-connector flyout, and show the HTTP connector in standard connector lists #271686.

featureImprove authentication options for Agent Builder connectors by listing recommended methods first with a Recommended badge and hiding legacy options when you create new connectors #273410.

+374 more items in the release notes

9.4.9 Nov 2, 2026 Release notes ↗

featureAdd options to include frozen tier data in Agent Builder tools. Frozen tier data stays excluded unless you opt in #297481, #299437.

featureSort agent policies alphabetically in the Assign new policy to agent modal #296067.

featureClarify in the Salesforce connector's document-level security tooltip that access applies per object type, not per record #297728.

fixFix bulk import not letting you select MCP tools that have no description #300886.

fixFix rules creating duplicate alerts, and leaving the original alerts active, when a rule run stops before it saves its state #293521.

fixFix rules and background tasks silently stopping for several minutes when a concurrent update prevents their completed run from being recorded #295415.

fixFix recurring tasks with rrule schedules running the same occurrence twice, or getting stuck after a timeout #297486.

fixFix the dashboard top menu and Edit button not appearing in embedded dashboards when show-top-menu=true is set #299599.

fixFix Lens metric panels failing to render when filters return no results and dynamic coloring uses a maximum dimension #297429.

fixFix an agent policy showing an outdated minimum Elastic Agent version after you upgrade several integration policies at once #294439.

fixFix integration policy edits not reaching Elastic Agent for packages that declare their Elastic Agent version requirement in the package manifest #296354.

fixFix agents enrolled by an older Fleet Server being left on a deleted version-specific agent policy #295107.

fixFix managed integration policy upgrades redeploying the agent policy once per integration policy, which slowed upgrades and could stall them when the Elastic Package Registry is unreachable #294411.

fixFix integrations that default to agentless deployment saving an agent-based policy when the integration also has a cloud connector option #299039.

fixFix deleting an agent policy silently leaving its ID in shared integration policies. The delete now fails with an error that explains the cause #300189.

fixFix Fleet bulk agent action APIs not validating the agents input consistently. Invalid input now returns a 400 error instead of running the action #299837.

fixFix the runtime field editor ignoring Save when you edit a field's script while the preview is still updating #294753.

fixFix the runtime field editor discarding the script when you change the field type to or from composite #299025.

fixFix saved object labels showing "index patterns" instead of "data views" when you copy a dashboard that references data views in another space #297621.

fixFix Discover showing an invalid time range from the URL instead of falling back to the default time range #290358.

fixFix field type icons staying stale in the field list when you recreate an index with a different mapping type for an existing field #301198.

fixFix the histogram Breakdown by button showing a breakdown field that can't be used for the chart #298832.

fixFix renaming a background search, or extending a search session's expiration, being reverted when the session status updates at the same time #296401.

fixFix the Url field formatter adding an extra /app segment to relative URLs that start with a slash when Kibana runs behind a base path or in a custom space #299116.

fixFix content connector indexes created from Kibana failing to ingest documents with large numeric IDs by mapping the document id field as keyword #297711.

fixFix the Rule ID, Metadata field, and Values tooltips on the query rules Create rule page not being announced by screen readers in Chrome with VoiceOver #295021.

fixFix tag filters in listing pages, such as the dashboards list, returning no results when a tag name contains an ampersand (&) #297231.

fixFix the Analytics overview page showing the Ingest your data section when you can't add data or upload files #297717.

fixFix paging through the API keys list showing the same API key on more than one page, or leaving a key out #296117.

fixFix Permissions-Policy violation reports reaching the configured reporting endpoint only for the last directive. Reports for every directive now reach it #299786.

fixFix Kibana's OpenTelemetry process resource exposing command-line arguments. Kibana now records the number of arguments instead #299043.

fixFix the data frame analytics audit messages API returning messages for jobs that don't exist in the current Kibana space #297821.

fixFix the ES|QL field statistics table being left empty when you change the query or time range while statistics are still loading #298642.

9.4.8 Oct 6, 2026 Release notes ↗

securityFixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…

fixFix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.

fixFix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.

fixFix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874.

fixFix Jira Service Management and Opsgenie connector actions failing when the rendered alert message exceeds 130 characters. The connectors now truncate the message instead #291698.

fixIncrease the TinyMath expression length limit so longer visualization formulas don't fail #290314.

fixFix Go to URL drilldowns leaving Mustache tokens such as event.values.[0] unreplaced in the drilldown name #290363.

fixFix deleting a managed integration policy leaving the agent listed as active #290181.

fixFix update and delete of legacy managed integration policies returning HTTP 404 or reporting success while the deployment kept running #287011.

fixFix agents for Elastic managed integrations enrolled in other Kibana spaces appearing in the Fleet Agents list #293142.

fixFix version-specific agent policy assignment failing repeatedly for agent policies in non-default Kibana spaces #293010.

fixFix the Fleet output edit flyout freezing or showing no counts when thousands of agent policies use the output #291972.

fixFix Elastic Agent upgrade and agent policy requests hanging for up to two minutes and failing with a reset connection when Kibana can't retrieve the list of available Elastic Agent versions #292788.

fixFix integration upgrades failing when you add a custom analyzer or normalizer to a @custom component template after the write index is created. Fleet now rolls over the data stream instead #291813.

fixFix Fleet installing only the first trained model when an integration package includes several #290145.

fixFix ambiguous_conflict errors on dashboard assets when you install an integration in multiple Kibana spaces #291648.

fixFix installed integration icons rendering as black shapes #293176.

fixFix the Edit pipeline button in the ingest pipeline details flyout moving off-screen when a processor contains a long value #291000.

fixFix Index Management moving component templates listed in ignore_missing_component_templates to the end of composed_of when you edit or clone an index template #290171.

fixFix Console reporting Elasticsearch request timeouts as connection failures. Console now explains that the request might still be running and suggests checking its status before you retry #289481.

fixAdd an Expand site group members toggle to SharePoint Online connectors for compact document-level security #288070.

fixAdd a Sync all mail folders option to the Outlook connector #291396.

fixFix deleted content connectors remaining in the connectors list #290859.

fixHide the Activate user action on deactivated users when you have read-only access #289801.

fixFix a failed audit log write after startup crashing Kibana. Kibana now reports a degraded state and turns the audit logger off instead #287360.

fixFix Kibana shutting down when the product documentation installer downloads a corrupt or incomplete artifact #291142.

fixFix PDF and PNG reports using too much memory and failing on memory-constrained instances when you generate them from a wide browser window #289062.

fixFix streaming inference requests returning no content when elasticsearch.compression is enabled, which made Agent Builder report an empty response #290381.

fixFix LLM feature settings listing every connector when you lack inference privileges, instead of only the allowed connectors #290457.

fixFix LLM resolution failing when you lack the Actions privilege and an inference endpoint is configured in model settings #290533.

fixFix the anomaly detection bucket span estimation API accepting an unlimited number of detectors, which could exhaust Kibana server resources #291203.

fixFix the field statistics flyout in the anomaly detection job wizard closing on its own while the wizard validates the job #292297.

9.4.7 Sep 15, 2026 Release notes ↗

securityFixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym…

securityFixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

fixFix alerting resource installation using unbounded concurrency, which could exhaust Kibana heap when many contexts and namespaces install at once #287643.

fixFix the Additional fields editor on the ServiceNow ITSM, ServiceNow SecOps, and Jira connectors rejecting Mustache context variables as invalid JSON #286578.

fixFix the Update filter button being unreachable when the filter editor is taller than the screen #289163.

fixFix Options list filters stopping after you delete a collapsible dashboard section #287923.

fixFix Canvas functions API creating data tables with more than 50 columns per row #287935.

fixFix the Maps timeslider close button registering clicks only on the top quarter of the control #287441.

fixFix Fleet blocking a package policy save when every enrolled agent is incompatible with the package version, including agents that report a pre-release version. Fleet shows a warning instead of blocking the save #289596.

fixFix managed integrations appearing in the Fleet Agents list when they use a version-specific policy #289394.

fixFix package policy space assignments becoming stale after you move an agent policy to another Kibana space #288966.

fixFix Elastic Defend metadata transforms accumulating as duplicates in Elasticsearch across stack upgrades #288379 #288902.

fixFix comment-only values in Fleet agent policy advanced YAML settings leaving agents stuck on an outdated policy #288430.

fixFix stale version-specific Fleet policies remaining after their agent version dropped out of the bounded set, and refresh variants that still have enrolled agents #287095.

fixFix the version-specific policy icon showing on agents that already meet the policy's version requirements #287504.

fixFix managed integration orphan cleanup so it respects package-policy ownership and the force flag #287571.

fixFix Fleet package policies keeping stale secret references after you rotate credentials #287642.

fixFix slow Fleet outputs fetching on Fleet setup and Integrations UI page load #287113.

fixFix classic streams leaving a stale Elasticsearch data stream mappings override after you remove all field overrides #288788.

fixFix Console treating request-like lines inside an unterminated triple-quoted string as standalone requests #287547.

fixFix Console body autocomplete preferring a same-name global rule over an explicit field rule #286703.

fixAdd an Expand role members toggle to ServiceNow connectors for compact document-level security #288071.

fixFix unexpected logouts after an access token is refreshed during a search or dashboard refresh #286038.

fixFix audit log records omitting the client IP address for requests made over HTTP/2 #285344.

9.4.6 Sep 1, 2026 Release notes ↗

securityFixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age…

securityFixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only…

securityFixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica…

securityFixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal…

featureAdd [Elastic Cloud Trial] prefix to email subjects sent through the built-in Elastic Cloud email service on trial deployments #276705.

featureAdd step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.

fixFix Agent Builder entering an infinite retry loop and hitting a recursion error when the plain-text answering path receives an empty model response #285823.

fixFix Anthropic inference endpoint stream parsing and Agent Builder silent retry loops on empty model responses #281616.

fixFix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when cross-cluster search index patterns are configured without the remote cluster client role #281609.

fixFix Anthropic inference endpoint requests sending temperature: 0 when no temperature was configured, causing unexpected model behavior in Agent Builder #281179.

fixFix alert suppression creating duplicate alerts when stored alerts use nested _source fields instead of flat dot-notation keys #282192.

fixFix by-reference Lens panels being removed from dashboards when their saved object references are missing #285476.

fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.

fixRemove the proxy configuration option from Kafka outputs, which don't support it #282313.

fixFix duplicate Cut, Copy, and Paste entries appearing in the Console context menu #286704.

fixFix Console autocomplete inserting boolean and numeric values as quoted strings instead of JSON primitives #286699.

fixFix Console body autocomplete failing after closed triple-quoted string values #286695.

fixFix Console autocomplete not triggering at request body positions, and correct template expansion and text corruption bugs when accepting suggestions #284530.

fixFix Console incorrectly showing autocomplete suggestions inside non-query triple-quoted strings #282424.

fixFix numeric field formats adding a sign prefix to values that round to zero #282919.

fixFix the percent field format displaying NaN when fractional is set to false #282915.

fixFix server-side date field formatting not reflecting timezone or pattern changes until Kibana is restarted #282501.

fixFix the Base64 Decode field format transform on the server side and for UTF-8 encoded data #281366.

fixFix PKI authentication sessions being unexpectedly invalidated when in-flight HTTP/2 requests are canceled, logging users out on TLS-enabled deployments #285153.

fixFix the Roles management page allowing navigation without warning when there are unsaved changes #283525.

fixFix Kibana failing to start when the audit log file location is misconfigured, and instead report a degraded state #282347.

fixFix the Data Frame Analytics results explorer not updating when switching to a different job of the same type #284964.

fixRestrict the trained model pipeline test endpoint to admin-level capabilities to prevent unauthorized data access #282002.

fixFix CSV exports generated by internal users (such as Fleet agent exports) failing with a parsing_exception error when xpack.reporting.csv.scroll.strategy: scroll is configured #286119.

fixFix the workflow editor blocking the Enabled toggle with an error when a foreach loop collection type cannot be statically proved #283360.

9.4.5 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by…

securityFixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…

securityFixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins…

securityFixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic…

securityFixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf…

securityFixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its…

securityFixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r…

securityFixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A…

securityFixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i…

securityFixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in…

securityFixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a…

securityFixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use…

securityFixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe…

securityFixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i…

securityFixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a…

securityFixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica…

securityFixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki…

securityFixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…

securityFixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV…

securityFixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…

securityFixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a…

securityFixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t…

securityFixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope…

securityFixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati…

securityFixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…

securityFixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of…

fixFix auto-created conversations overwriting an existing conversation that shares the same ID #280189.

fixFix attaching AIOps charts (change point, pattern analysis, log rate analysis) to a case failing with an "Attachment type is not registered" error #281157.

fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, the corrected behavior applies only to reports created or re-saved after upgrading; existing schedules keep their previous time-window behavior until they are recreated…

fixFix the alerts-as-data setup overriding an index's total fields limit that was already set to a higher value #277402.

fixFix duplicated Lens panels backed by a form-based ad hoc data view failing to load after you rename the data view or add a runtime field, caused by colliding ad hoc data view IDs #281786.

fixFix ad hoc data view resolution for Lens XY annotation layers created through the Visualizations API #281079.

fixFix the Visualizations API dropping the custom display name of inline (ad hoc) data views on round trip #280546.

fixFix dashboard PDF exports using a stale time range after you change the time picker when the dashboard does not save the time range #278262.

fixFix Fleet output edits failing with a validation error when more than 10 hosts were configured, by raising the host limit from 10 to 100 for Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs #282397.

fixFix the expiration parameter on POST /enrollment_api_keys being silently dropped, and add an Expiration field to the Create enrollment token form in Fleet #281324.

fixFix OpenTelemetry integration metrics not defaulting to the time_series index mode #281295.

fixFix the agent policy filter on the Agents list returning no agents for version-specific policies #281195.

fixFix the Add Fleet Server onboarding continuing to show after the Fleet Server agent moves to a version-specific policy #281092.

+13 more items in the release notes

9.4.4 Jul 21, 2026 Release notes ↗

securityFixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th…

securityFixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func…

securityFixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…

securityFixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…

securityFixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…

securityFixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…

securityFixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c…

securityFixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ…

securityFixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…

securityFixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv…

securityFixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…

securityFixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu…

securityFixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

securityFixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…

securityFixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…

securityFixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t…

featureAdds a cases.pushCases workflow step that pushes the given cases to their external connectors #267539.

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

featureSupports overriding data_stream.type in the simplified package policy API for input-only packages, so collected data can be routed to a different index prefix with matching agent index permissions #269895.

featureAdds a MongoDB connector datetime_conversion setting so syncs can clamp, convert, or error on dates outside the supported range instead of always aborting #277685.

fixImproves the Cases file upload modal with human-readable size limits, clearer unsupported-type messaging, per-file size checks, and error state that clears when a new file is selected #277567.

fixFixes OAuth client credentials token parsing so any 2xx response is treated as success #276321.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes ES|QL query rules dropping parentheses when appending a limit, which could change calculated results #275231.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixExtracts observables automatically when alerts are attached to a case through the comments API #274969.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixFixes the Google Drive connector so it can find and read files owned by a shared drive #274303.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes startup crashes from occurring when upgrading Kibana if a previous version's node.options file was preserved, caused by server-side imports of the browser-only @elastic/charts library #276284.

fixFixes horizontal padding in the Lens dimension editor #275993.

fixFixes the filter popover so that closing the context menu when saving a dashboard doesn't discard changes #275987.

fixFixes invisible field names in the Lens field picker when in dark mode #275785.

fixFixes incorrect color rendering for non-custom palettes in Lens metric charts #275203.

fixFixes color rendering in Lens gauge charts so a color band no longer extends past the configured range, and palette continuity is preserved on save #272123.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixFixes integration policy updates always bumping associated agent policy revisions, even when bumpRevision is false #275626.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes adding content connectors from Integrations so the enrollment flyout links to connector setup instead of waiting for incoming data #274832.

+24 more items in the release notes

9.4.3 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio…

securityFixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…

securityFixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…

securityFixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc…

securityFixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…

securityFixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…

securityFixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…

securityFixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us…

securityFixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under…

featureAdds xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control the Elasticsearch index.mapping.total_fields.limit on .alerts-* indices, index templates, and component templates. Raise this above the current alert mapping field count to prevent mapping-update failures…

fixFixes ES|QL query escaping in the Dashboard skill's visualization config generation, ensuring patterns such as GROK retain the correct escape levels when queries are embedded as JSON #272493.

fixFixes the Stack Alerts page triggering two search cycles on initial load when filter controls are present, which could cause a brief flash of unfiltered results #271441.

fixFixes dashboard filters not being applied after collapsing a section that was expanded on initial load #272751.

fixFixes dashboards with panel or filter arrays that exceed schema size limits failing to load, by removing the array-size ceiling from internal read requests #271326.

fixImproves dashboard load resilience by validating each state key independently, dropping invalid panels, filters, or queries with warnings rather than failing the entire load #270300.

fixIncreases the maximum number of combined panels, sections, and controls on a dashboard from 100 to 1,000 #272931.

fixFixes Save and return not working for Maps visualizations opened from the Visualize library #274002.

fixFixes a stale closure in the Canvas autoplay timer that could skip pages after slides are added or removed #268398.

fixDisables the experimental Defer loading panels below "the fold" dashboard setting (labs:dashboard:deferBelowFold) because enabling it can cause some dashboards to fail to load. The option remains in Advanced Settings but has no effect from this version. It might be enabled again in a future…

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixImproves POST /api/fleet/setup performance for deployments with many configured outputs by fetching only the required outputs instead of decrypting all saved outputs on each call #273848.

fixOptimizes the agent policies list endpoint (withAgentCount=true) to compute agent counts using a single aggregation instead of multiple queries per policy, greatly improving response time for large deployments #272429.

fixPrevents the agent version check from hanging indefinitely in air-gapped or firewall-restricted environments, and adds xpack.fleet.productVersionsApiTimeoutMs (default: 60 s) to control the request timeout #272715.

fixFixes variable leakage and duplication across policy templates in input packages that define multiple policy templates #273364.

fixIncludes input packages in the Integrations Signal type filter #272585.

fixFixes security rule names not displaying in the integration Assets accordion #272089.

fixFixes the agent logging level dropdown not updating after clicking Reset to policy on the agent Settings tab #271964.

fixFixes broken asset references in the integration Assets tab when an integration is reinstalled or upgraded from a different Kibana space #271800.

fixFixes per-integration output overrides for OpenTelemetry (OTel) integrations, and now raises a validation error when an unsupported output type is assigned instead of failing silently #270487.

fixFixes null and undefined field values in the ES|QL document summary column incorrectly counting toward the discover:maxDocFieldsDisplayed limit, which caused fields with real values to be hidden #273610.

fixFixes the Extend action icon in the Background searches panel being invisible in dark mode #272754.

fixFixes Discover session panels in dashboards failing to load after Copy to Spaces or import when the target space already contains remapped sessions #272610.

fixFixes a regression where KQL autocomplete suggestions stopped working in the ES|QL editor #273931.

fixFixes editing of object fields in the ES|QL lookup index editor when using dot-notation column names #273303.

fixAdds notifications.connectors.default.email as a Docker environment variable #272761.

fixFixes user profile retrieval in reverse proxy run_as configurations, ensuring the nav bar displays the effective user's avatar and name rather than the proxy user's #271314.

fixFixes product documentation installation timing out when the ML inference endpoint scales up from zero replicas (cold-start), and improves error messages when installation fails #270005.

fixLogs Dev Tools Console requests through the elasticsearch.query debug logger (method, path, and response status; request bodies are not included since Console streams them), and adds support for URL path prefixes in elasticsearch.hosts for Console proxy requests #271562.

fixFixes workflow executions that become orphaned from Task Manager now being cancelled immediately rather than waiting indefinitely for an asynchronous cancel #272672.

9.4.2 May 28, 2026 Release notes ↗

securityFixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…

securityFixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…

securityFixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…

securityFixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…

securityFixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…

featureImproves the Add inference endpoint and Edit inference endpoint flyouts with clearer titles, a footer Save button, task type descriptions in the selector, always-visible endpoint ID and API reference fields, and inline validation for required fields #262143.

fixFixes an issue that caused rules with large action parameter payloads to fail when saving or executing #269467.

fixFixes case workflow templates resolving from the wrong owner #268719.

fixFixes phrase search in the All Cases view #266827.

fixFixes the email connector to reject malformed email addresses (for example, local parts or domain labels with leading or trailing hyphens) that mail servers would reject, preventing unnecessary SMTP connection attempts #268496.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and space URL prefixes, preventing 404s on connector detail tabs and after creation #269571.

fixFixes the links panel transform to remove an unsupported enhancements property #270230.

fixFixes the Lens API so XY charts with legends at the top or bottom return the correct configuration #268729.

fixFixes the Lens Visualization API rejecting rank_by with operation: "count" on terms buckets when no field is specified, so Count can rank by all documents without a field #268620.

fixFixes the Visualization API to correctly show default datatable colored badges #268425.

fixFixes gauge chart min, max, and goal configuration to reject unsupported reference-based metric operations (moving_average, differences, cumulative_sum, counter_rate) that require a date histogram #268168.

fixParses top-level elasticsearch fields in integration packages on upgrade or reinstall #269080.

fixFixes the agent enrollment Confirm incoming data step timing out for integrations that ingest backdated data by checking event.ingested instead of @timestamp #268224.

fixPreserves the expanded document selection after refresh when comparing documents in Discover #268328.

fixAllows null in CASE() expressions combined with other types #269051.

fixFixes missing modal and popover labels for screen readers across Stack Management UIs #269652.

fixFixes File upload not disabling data view creation when the user lacks data view creation capabilities #268167.

fixMakes the with block optional in workflow YAML for connector steps that have no required parameters #269047.

9.4.1 May 12, 2026 Release notes ↗

fixFixes empty rule type fields, such as kibana.alert.reason, on active alert documents when a delayed alert graduates to active during a flapping hold without an executor report. #266012

fixFixes a critical validation failure that occurred when dashboard controls had null titles. Control titles are now converted to undefined during transforms, allowing validation to pass #268220.

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the ES|QL control edit flyout when editing an existing query-based control #267605.

9.4.0 May 5, 2026 Release notes ↗

securityFixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…

featureMakes maximumCasesToOpen a runtime property #259255.

featureAdds an auto-push case option to the case connector #249251.

featureExposes the maximumCasesToOpen parameter in the case action connection #247990.

featureAdds additional workflow steps #256922.

featureAlert deletion is now generally available #247465.

featureUpdates Test tool flyout to support datetime picker #249549.

featureSimplifies the ES|QL test tool parameter types #249855.

featureExposes configuration_overrides in agent_builder/converse API #249256.

featureAdds support for array parameter types in ES|QL tools #250386.

featureMigrates the flyout to a sidebar #252918.

featureAdds server-side support for user-created skills in Agent Builder #252493.

featureAdds agent and tools RBAC sub features #254464.

featureAgent Builder's default agent is no longer read-only and can now be customized per Kibana space #256333.

featureAdds user-created skills to Agent Builder #252221.

featureAllows Agent Builder to detect outdated attachments and lets users refresh them into the next message #257658.

featureAllows ES|QL generation to search index patterns #253492.

featureAllows agents to run one or more workflows before each execution, enabling prompt modifications or conditional abort #252452.

featureAdds audit logging for agent and tool create, update, and delete actions #252143.

featureAdds support for the region parameter to the Bedrock Connector #252956.

featureAdds a Jina Reader data source connector #247527.

featureAdds a Jira Cloud data source connector #251345.

featureAdds a SharePoint Online data source connector #251544.

featureAdds a ServiceNow data source connector #252430.

featureAdds a Microsoft Teams data source connector #252465.

featureAdds a Tavily data source connector #252717.

featureAdds a Google Calendar data source connector #252740.

featureAdds a Slack data source connector #252972.

featureAdds an Amazon S3 data source connector #253753.

featureAdds a Salesforce data source connector #254303.

featureAdds a Zendesk data source connector #254739.

featureAdds a Firecrawl data source connector #255004.

featureAdds a 1Password data source connector #255076.

featureAdds a PagerDuty data source connector #255154.

featureAdds a Zoom data source connector #255174.

featureAdds a Figma data source connector #255322.

featureAdds a Gmail data source connector #255565.

featureAdds an AWS Lambda data source connector #256150.

featureAdds a Confluence Cloud data source connector #256508.

featureAdds a Google Cloud Storage data source connector #257374.

+397 more items in the release notes

9.3.8 Jul 21, 2026 Release notes ↗

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

fixPrevents the Task Manager invalidate task from invalidating an API key that is still shared by other live tasks, which caused those tasks to fail with a security exception #275157.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes escape_string values that contain double quotes from corrupting surrounding agent policy YAML #279391.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes Console autocomplete so nested object fields and multi-fields in index mapping bodies suggest mapping options again #278508.

fixFixes Console requests that combine comments with triple-quote strings failing with x_content_e_o_f_exception #277259.

fixFixes a Windows-specific code editor issue that could corrupt multi-line edited text after refresh #277007.

fixFixes the Console Copy button silently failing to copy response output #276365.

fixFixes Console autocomplete matching an incorrect API endpoint when a URL matches both a literal path and a parameterized path #276239.

fixImproves Console ES|QL source autocomplete by reusing a fresh source list instead of refetching it on every keystroke #275535.

fixPrevents removing all spaces from a machine learning job or trained model through the spaces update APIs #276490.

fixRestricts the clear audit messages API so users can only clear messages for jobs they can access, and only against valid notification indices #276419.

fixFixes a crash in ES|QL query correction when an LLM generates a multi-line WHERE clause #277153.

9.3.7 Jun 30, 2026 Release notes ↗

fixFixes case pushes only stamping a subset of attachments, which caused the alert count comment to be duplicated in the external system on every push #274451.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes Canvas autoplay not advancing past the first page #272619.

fixFixes the agentless enrollment flyout for content connector integrations to show a connector configuration link instead of waiting for incoming data that cannot arrive until the connector is set up #274832.

fixImproves POST /api/fleet/setup performance for deployments with a large number of configured outputs by no longer decrypting every output on each call #273848.

fixFixes integration category filters sticking in place when scrolling the Integrations page on mobile #273499.

fixFixes a crash in the Integrations view when a package has no icon #273191.

fixFixes the ES|QL document summary column counting null values against the displayed field limit, which could hide fields with real values behind an "and X more fields" label #273610.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixFixes the Files plugin blob download to return the requested file type #274783.

fixFixes Dev Tools Console autocomplete in query filter context to suggest query DSL instead of the obsolete Elasticsearch 1.x filter DSL #272907.

9.3.6 Jun 23, 2026 Release notes ↗

fixFixes the Stack Alerts page fetching alerts twice on initial load by deferring table rendering until filter controls have finished initializing #271441.

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixFixes a stale closure in the Canvas autoplay timer that could advance to the wrong slide when slides were added or removed while autoplay was running #268398.

fixOptimizes GET /api/fleet/agent_policies (with withAgentCount=true) to compute agent counts in a single bucketed aggregation instead of multiple queries per policy, significantly reducing response time for deployments with many agent policies #272429.

fixFixes integration package reinstalls and upgrades performed from a space different from the original installation space incorrectly bucketing Kibana asset references, causing the Assets tab to display raw UUIDs instead of asset titles #271800.

fixFixes variable leakage and duplication between policy templates in input packages that define multiple policy templates #273364.

fixFixes security rule names not displaying in the integration Assets accordion when the rule object has no title field #272089.

fixFixes the agent logging level dropdown on the Settings tab not updating after Reset to policy is applied, so the displayed level now stays in sync with Fleet-polled agent metadata #271964.

fixFixes the Extend action icon in the Background searches row actions menu being invisible in dark mode by rendering it as an inline SVG that inherits the surrounding icon color #272754.

fixFixes slow KQL parsing caused by long runs of whitespace by improving keyword-adjacent whitespace handling in the KQL grammar #266512.

fixAdds notifications.connectors.default.email to the list of supported Docker environment variables #272761.

9.3.5 May 28, 2026 Release notes ↗

securityFixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…

securityFixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…

securityFixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…

securityFixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…

securityFixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…

fixFixes Elastic Stack rule upgrades failing when rule action params values exceed Elasticsearch field size limits by adding ignore_above: 4096 to the actions.params mapping #269467.

fixFixes alert index template updates failing when auto-increasing total_fields.limit because system-managed read-only fields were included in the update request #262534.

fixFixes phrase search in the All Cases view so quoted queries match exact phrases and unquoted queries match individual terms #266827.

fixFixes the email connector to reject malformed email addresses (for example, addresses with leading or trailing hyphens in the local part or domain labels) that mail servers would reject, preventing unnecessary SMTP connection attempts. Existing connectors saved with invalid addresses will fail…

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the control edit flyout when editing an existing query-based variable control #267605.

fixFixes agent policy background tasks failing with a parse_exception by sorting agent policies on updated_at instead of the non-existent created_at field #267285.

fixFixes a race condition during async integration knowledge base installation that could clear installed_es asset references for input packages and leave the Assets tab blank #266841.

fixUses password fields instead of cleartext inputs for multi-value secret variables in integration policy forms #266823.

fixFixes an issue in Discover's ES|QL mode so the expanded document flyout correctly stays on the same result after a refresh when METADATA _index, _id is available, and shows the original document without pagination when that result is no longer in the refreshed set #268328.

fixEnsures CSV exports from Discover use the absolute time range for the current session so exported data matches what you see on screen #255005.

fixFixes date conversion in the file sharing service #265131.

fixFixes Anomaly Detection chart markers in the Single Metric Viewer so sparse data points with a single value in the chart time range remain visible without hovering #263632.

fixFixes the IP Location processor in Ingest pipelines saving the wrong database_file and showing duplicate selections when a local database filename matches a managed database label #265740.

fixAdds accessible names to modals and popovers across Stack Management pages to improve screen reader support #269652.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and Kibana space prefixes, resolving 404 errors on connector detail tabs and the post-creation Manage connector action #269571.

fixPrevents each keystroke in the Advanced Settings search bar from adding a browser history entry, so the back button navigates away from the page in one step #266278.

fixFixes query rules API routes to limit the maximum size of arrays accepted in request data #265495.

fixFixes the Search Applications document explorer rendering HTML markup from field .snippet values #265319.

9.3.4 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…

featureRemembers the pagination state when navigating back from an edit on the Users page, instead of always returning to page 1 and resetting the search #261152.

fixFixes an issue where Stack alerts sent recovery notifications but remained active in Kibana instead of transitioning to recovered #261012.

fixAdds the application/x-zip-compressed MIME type as an accepted value for case file attachments #262414.

fixFixes the "Failed to check if maintenance windows are active" error #261048.

fixFixes YAML file downloads being truncated at the first # character by properly URL-encoding the content #264083.

fixFixes package policy count filters to correctly identify non-latest revisions #263717.

fixOnly auto-installs content packages that are newer than the installed version #262509.

fixFixes Fleet Server diagnostic bundles failing to download when elasticsearch.compression is enabled #262394.

fixFixes missing sort-state announcements for screen readers in the Ingest pipelines list #262226.

fixFixes focus management for the Learn more link #261902.

fixFixes screen reader announcements for the Define as JSON toggle #261896.

fixFixes screen readers announcing duplicate row indices in the Ingest pipelines list #261369.

fixFixes the inference processor form to accept the input_output configuration shape #260517.

fixFixes screen readers announcing icon labels twice in the Ingest pipelines list #259185.

fixFixes screen readers incorrectly combining button announcements on the Create Pipeline page #261603.

fixFixes stale screen reader announcements in code boxes #261921.

fixFixes the transforms detail summary to show all source_index entries when source_index is an array #261875.

fixFixes screen readers announcing search template options twice #261585.

fixFixes screen readers announcing duplicate row indices on the data streams table #261366.

fixFixes screen readers announcing icon labels twice in the Edit policy flyout #261324.

fixFixes screen readers announcing policy actions tooltip text twice in the index lifecycle policies list #261322.

fixFixes screen readers announcing copy button labels twice #261311.

fixFixes screen readers announcing grey color badge text twice in the transforms list #261307.

fixFixes screen readers not announcing invalid field validation errors #260673.

fixResets the time field when the updated index pattern does not include it #262001.

fixFixes ES|QL multi-value filtering with STATS #260998.

fixAdjusts the API Key flyout width #263858.

fixAllows space colors to be cleared, falling back to the default #261826.

fixFixes screen readers announcing data stream and index options twice in the Create policy and Restore snapshot selectable lists #261786.

fixFixes policy buttons to have distinguishable names for screen readers #261313.

fixFixes the single metric chart in Anomaly Explorer not showing anomaly actions correctly #263925.

fixUpdates the hono and @hono/node-server dependencies #263794.

fixFixes execution tree clipping when foreach has many iterations #253576.

9.3.3 Apr 8, 2026 Release notes ↗

securityFixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…

securityFixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…

securityFixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…

securityFixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server…

securityFixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest…

securityFixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…

fixFixes Webhook Connector accessTokenUrl validation #258290.

fixAdjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.

fixFixes Canvas library embeddables failing to load when savedObjectId is present without saved object references #257779.

fixFixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.

fixFixes Add from library in Canvas creating incorrect embeddable state #257261.

fixFixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes are saved #256984.

fixImproves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.

fixFixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.

fixFixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies are also counted #258387.

fixRestores keyboard focus to the Create a transform button on the Transforms page #258095.

fixEnhances screen reader notifications for bulk actions in Index Management tables, providing live announcements when the bulk actions menu becomes visible or hidden #257089.

fixFixes the query rules UI rejecting case variants as duplicate values #259506.

fixFixes only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.

fixPrevents creating incompatible inference endpoints when adding a semantic_text field in the Index Management mappings editor #256586.

fixFixes the anomaly swim lane dashboard panel not refreshing #259962.

fixFixes a console error when opening the data frame analytics jobs list #258591.

fixAdds aria labels to job wizard combo boxes #258509.

9.3.2 Mar 19, 2026 Release notes ↗

securityFixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn…

securityFixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…

featureAdds Gemini 2.5 Flash Lite, Claude 4.5 Haiku, and Claude 4.6 Sonnet models to preconfigured connectors #253109.

fixFixes a bug in the platform.core.search tool and index_search tool type where nested fields were ignored when searching for matching documents #255914.

fixFixes MCP connectors ignoring the proxy and SSL configuration from the actions plugin (xpack.actions configuration property) #255813.

fixFixes a problem generating a report with multi-page Canvas workpads #255022.

fixFixes a blank page appearing at the end of PDF exports when using the Print format option with an even number of dashboard visualizations #254957.

fixImproves handling of 204 responses #251090.

fixFixes an issue where embedded panels in Canvas workpads could lose their saved object references, causing panels to fail to load #252191.

fixFixes the Add from library action adding incorrect embeddable state #257261.

fixFixes Lens transforms #257224.

fixFixes an issue where dashboard panels could get stuck in an infinite loading state after an error instead of showing error messages #257188.

fixFixes Maps failing to load when the stored time filter contained a quick mode value #255178.

fixFixes the unenroll task and adds an FTR test #255726.

fixFixes the incorrect installation of assets #254923.

fixFixes glitchy rendering in the Attributes tab #255173.

fixFixes the spaces list displaying No spaces match text on load #255654.

fixFixes the embeddable console auto-closing on chrome or overlay clicks #253382.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixAdds waitFor for the privilege button #255094.

fixFixes an issue where saving a dashboard included access control features when a user profile was not available #255065.

fixFixes screen reader announcements for flyouts #256409.

fixImproves name announcement in the index mode modal #256392.

fixFixes an issue in Dev Tools Console where syntax highlighting broke when queries contained accented or non-ASCII characters #255649.

fixFixes an issue in Dev Tools Console where closing nested braces broke syntax highlighting for subsequent elements #255426.

fixChanges the Run in Console button type #256455.

fixFixes Search Playground routes to limit the maximum size of arrays #255881.

fixFixes focus behavior when there are errors in the connector flyout form #255770.

fixAdds server-side API key generation #256083.

9.3.1 Feb 26, 2026 Release notes ↗

featureAllows integration rollback even if all package policies are not on an upgraded version #253646.

featureAdds a dynamic default connector to GenAI settings #252861.

featureAdds missing ES|QL commands and functions documentation for inference tasks #249089.

fixFixes a bug with PagerDuty where setting the Custom details field causes rules to fail #253683.

fixAdds external reference IDs to the attached documents check when a case is selected #253107.

fixFixes rule execution failing due to null execution UUIDs #252618.

fixImproves handling of 204 responses #251090.

fixFixes AI Connector form fields incorrectly resetting to default values when cleared with backspace #251095.

fixUpdates connector description terminology to reference "pre-configured AI connectors" #250649.

fixFixes layer editor scrolling in the full Lens editor #253247.

fixFixes runtime_mappings being ignored or overridden in Vega specs when defined in data[].url.body #253560.

fixFixes an issue where an agent rolled back after an upgrade could not be upgraded again in Fleet UI #253850.

fixFixes the handling of missing values #251892.

fixStrips system-managed date fields from ingest pipelines before PUT requests #252579.

fixFixes Stack Monitoring breadcrumb when in solution view #249751.

fixFixes "today" and "this week" filters for Log Rate and Pattern Analysis embeddables #252925.

fixFixes word break in Anomaly Detection page titles #250058.

fixFixes autocomplete not working in embedded console #253306.

fixFixes an issue loading the doc count in index management when viewing larger page sizes with long index names #252422.

fixFixes a validation error for AI pipeline suggestions with empty grok patterns #251113.

fixFixes the homepage throwing errors when the license level is below Enterprise #251484.

fixReduces background polling on the Index Details page to avoid unnecessary API requests #251446.

fixFixes links being visible on Search homepage when the user doesn't have access #251437.

fixAdds datemath support to the KQL evaluator #252840.

9.3.0 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could…

featureElastic Agent Builder is now generally available. It is enabled by default in Elasticsearch solution environments, and you can opt in to Agent Builder and its AI Agent chat experience in Observability and Security solution environments. Learn how to get started.

featureSupports searching for report schedules by title and creator #243841.

featureProvides fields for specifying cc and bcc recipients, the subject line, and the message for scheduled report email notifications #242922.

featureEnables incremental human-readable case IDs #238555.

featureAdds option to delete report schedules #238197.

featureAlert cleanup is now generally available #247465.

featureAdds search to the new Attachments tab in cases #246265.

featureAdds support for searching rules by their actions' params using the API #246123.

featureScheduled reports are now generally available #245882.

featureThe Slack connector can now be configured to send messages to any channel using channel names #245423.

featureImproves search on the case management page #245321.

featureAdds option to enable disabled report schedules #244202.

featureDisable flapping per rule - schema only changes #243855.

featureCentralizes tabs for different attachement types under the new Attachments tab in cases #243708.

featureAdds a date time picker to the cases management page to help you find cases that were created during a specific time range #243409.

featureAdds option to edit report schedules #241928.

featureImproves UI for specifying additional fields for IBM Resilient action #238869.

featureMakes Agent ID the default observables type #238533.

featureAdds kibana.alert.index_pattern to all Stack alerts. This change doesn't affect detection alerts #239450.

featureElastic will regularly be adding new AI models from 9.3 onwards which will appear as pre-configured AI connectors in Kibana. Refer to the Elastic Inference Service page for more details.

featureAdds Groq to the list of available providers for the Inference/AI Connector and for Inference endpoint creation #244962.

featureIntroduces a Brave Search connector #245329.

featureThe webhook connector now supports the following HTTP request methods: POST(default), PUT, PATCH, GET, and DELETE #238072.

featureAdds new preconfigured connectors and updates existing ones #242791.

featureAdds a new temperature parameter to AI Connector and to OpenAI, Bedrock, and Gemini connectors #239806.

featureAdds support for headers in the OpenAI integration #238710.

featureDashboards now support ownership and "write_restricted" mode. You can now keep dashboards publicly editable or in a write-restricted state until they are ready to be published, giving you more control over who can edit your dashboards, regardless of broader space permissions #224552.

featureAdds support for chaining variable controls. You can now set up variable controls to depend on the values selected for another variable control #242909.

featureAdds basic filtering support for interactions with ES|QL charts #243439.

featureRemoves the Supporting visualization section heading from the Primary Metric editor. All configuration options remain fully accessible in the same location under Appearance #245979.

featureReorganizes and renames color settings in the Primary Metric dimension editor. For numeric metrics, the "Color by value" and "Color mapping"/"Color" settings are now located under the "Background chart" field. The settings have been renamed as follows: "Color by value" is now "Color mode", and…

featureIn dashboard visualization in-line editing and Lens workspace, the 'Appearance', 'Titles and text', 'Axis', and 'Legend' settings have been moved from a popover into a dedicated flyout panel #240804.

featureMoves the Lens visualization toolbar from the workspace section to the configuration panel #239879

featureMoves the Save as and Reset options under the top nav Save button when the dashboard is in edit mode #237211.

featureThe Lens configuration panel has been redesigned to display layers as tabs instead of vertically stacked panels. Layer actions (clone, remove, save) are now accessible through a menu in each tab, improving the editing experience when working with multiple data layers, annotations, and reference…

featureEnables integration knowledge generation by default and adds a UI setting that allows you to opt out of the integration knowledge indexing #245080.

featureEnables rolling back integrations to the previously installed version #240761.

featureAdds capability for rolling back a recent upgrade of a Fleet-managed Elastic Agent using Fleet UI or API #247398, #249416.

featureAdds functionality for removing root privilege from Fleet-managed agents if applicable #237790.

+197 more items in the release notes

9.2.8 Apr 8, 2026 Release notes ↗

fixFixes Webhook Connector accessTokenUrl validation #258290.

fixAdjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.

fixFixes Canvas library embeddables failing to load when savedObjectId was present without saved object references #257779.

fixFixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.

fixFixes Add from library in Canvas creating incorrect embeddable state #257261.

fixFixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes were saved #256984.

fixEnsures the log level from the assigned policy is used when an agent configuration doesn't mention one #259425.

fixImproves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.

fixFixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.

fixFixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies were also counted #258387.

fixRestores keyboard focus to the Create a transform button on the Transforms page #258095.

fixFixes the query rules UI rejecting case variants as duplicate values #259506.

fixPrevents only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.

fixFixes the anomaly swim lane dashboard panel not refreshing #259962.

9.2.7 Mar 19, 2026 Release notes ↗

fixFixes a blank page appearing at the end of PDF exports when using the Print format option with an even number of dashboard visualizations #254957.

fixImproves handling of 204 responses #251090.

fixFixes an issue where embedded panels in Canvas workpads could lose their saved object references, causing panels to fail to load #252191.

fixFixes an issue where dashboard panels could get stuck in an infinite loading state after an error instead of showing error messages #257188.

fixFixes the unenroll task and adds an FTR test #255726.

fixFixes the incorrect installation of assets #254923.

fixFixes the spaces list displaying No spaces match text on load #255654.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixAdds waitFor for the privilege button #255094.

fixImproves name announcement in the index mode modal #256392.

fixFixes an issue in Dev Tools Console where syntax highlighting broke when queries contained accented or non-ASCII characters #255649.

fixFixes an issue in Dev Tools Console where closing nested braces broke syntax highlighting for subsequent elements #255426.

fixFixes Search Playground routes to limit the maximum size of arrays #255881.

fixAdds server-side API key generation #256083.

fixFixes glitchy rendering in the Attributes tab #255173.

fixFixes EQL sequence document merging to treat dot and nested notation the same #254830.

9.2.6 Feb 26, 2026 Release notes ↗

securityFixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s…

securityFixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC…

securityFixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

fixFixes rule execution failing due to null execution UUIDs #252618.

fixFixes runtime_mappings being ignored or overridden in Vega specs when defined in data[].url.body #253560.

fixFixes the handling of missing values #251892.

fixStrips system-managed date fields from ingest pipelines before PUT requests #252579.

fixReduces background polling on the Index Details page to avoid unnecessary API requests #251446.

9.2.5 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

securityFixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

fixFixes timestamp override for ES|QL CSV scheduled reports with relative time ranges #248169.

fixFixes an issue with dashboard PDF/PNG reports being cut off at the end when the dashboard has a markdown panel #249644.

fixFixes an issue with the "Search entire time range" option that could exclude some results if the time field was set to date nanos #248495.

fixFixes an issue where document viewer tabs were unnecessarily re-mounting on every refresh, leading to degraded performance #248203.

fixFixes an issue causing query drafts to be lost when switching between tabs without running the query first in ES|QL mode #247968.

fixFixes an issue with the Share menu where all time ranges were being shared as absolute #248804.

fixFixes an issue with certain properties causing failures when adding a policy to an index template #249168.

fixFixes an issue with duplicated managed ILM policies still appearing as managed #248586.

fixFixes Stack Monitoring Recent Log Entries' timestamps to respect Kibana's time zone setting (dateFormat:tz) #249016.

fixFixes the breadcrumb when navigating to the Stack Monitoring page while using a solution view #249751.

fixFixes occasional file preview corruption during file uploads #250532.

fixUpdates Packetbeat DNS tunneling datafeed to include runtime mappings #249317.

9.2.4 Jan 13, 2026 Release notes ↗

securityFixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…

securityFixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…

securityFixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…

securityFixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…

fixAdds maximum character validation to the email connector params and configuration #246453.

fixAdds encoding to search terms in the Cases page to prevent decoding errors #247992.

fixUpdates total events in Elasticsearch document when attaching an event to a case #247996.

fixFixes compound filters showing unsaved changes on dashboard load #247309.

fixFixes the default app state handling when detecting unsaved changes #246664.

fixFixes an issue with ES|QL tabs not loading properly #246941.

fixFixes createAuditEvents always returning failure as the outcome #247152.

fixAdds case sensitivity to the index privileges fields on the Edit roles page #246069.

fixDisables field statistics for ES|QL with TS command #247641.

fixFixes the display of map view in Data Visualizer for small screen sizes #247615.

fixFixes an issue with queries getting malformed in anomaly charts, which was preventing the charts from rendering #246841.

fixUnifies the flow for clients partially and fully authorized to saved objects, and applies the intersection of allowed and authorized lists #244967.

fixFixes an issue where users running Elasticsearch with basic licenses would encounter errors when updating index mappings. Now, the Machine Learning saved object check will only run if saving semantic text mapping #248462.

9.2.3 Dec 19, 2025 Release notes ↗

securityFixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…

securityFixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…

securityFixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…

featureAdds the background task FleetPolicyRevisionsCleanupTask which removes excess policy revisions from the .fleet-policies index #242612.

featureThe API keys management page now defaults to showing personal API keys only #245261.

featureAdds a warning when deleting API keys currently used by alerting rules #243353.

fixFixes an issue that caused the Security alerts table to not update columns correctly when switching view modes #245253.

fixAdds consecutiveMatches to action context #244997.

fixFixes an issue with Discover tabs that occurs when navigating to a different tab while the previous tab is still initializing #245752.

fixFixes Discover's trace waterfall behavior with duplicate spans #244984.

fixFixes "now" and mixed-format date handling in the Share menu #245539.

fixFixes an issue with authentication when multiple OIDC providers are configured #243869.

fixFixes an ECS incompatibility with the kibana_started.elasticsearch.waitTime value in logs #245706.

fixFixes the serialization of meta.error in JSON layouts. If it is an Error instance, only message, name, and stack are included. Other fields are no longer returned in the logs #244364.

fixFixes JVM metric conflicts with explicit cast #244151.

9.2.2 Dec 2, 2025 Release notes ↗

securityFixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…

securityFixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…

fixCaptures connector errors without interrupting the case creation flow. Issues with connectors can be resolved on the case details page #244188.

fixImproves error message for IBM Resilient connector failing to create an incident #244012.

fixFixes auto-extraction of observables when alerts are added to a case using the bulk actions menu #242325.

fixFixes pagination for the Alerts table, which was getting stuck on rule details pages #242275.

fixUses max_value instead of infinity for the default maximum height of a panel #243572.

fixFixes issue with saving dashboards after changing the dashboard link to an external link #243134.

fixFixes error that occurs when you deselect the (blank) option from the filter controls menu #242036.

fixUses long expiration for upgrading agents #243443.

fixFixes retrying agents stuck in auto-upgrade logic #243326.

fixAdds retry behavior for /api/fleet/agents when transient issues with Elasticsearch are encountered #243105.

fixFixes Docker image in the Add agent Kubernetes manifest #242691.

fixFixes truncation for longer text in the Discover table #241440.

fixFixes the production build favicon's CSS specificity #243351.

fixFixes an issue on the Index management page where screen reader text was different from visible text #243802.

fixFixes an issue with keyboard focus getting trapped on pages using document preview #243791.

fixEnsures deleted text in AI connector or Inference endpoint forms is not sent as empty strings #244059.

fixFixes data views showing runtime fields twice #242557.

fixFixes import and improves validation for Anomaly Detection and Data Frame Analytics jobs #242263.

fixTurns off custom suggestions on embedded console #241516.

9.2.1 Nov 11, 2025 Release notes ↗

featureThe defaultRoute advanced setting now controls the target of the Elastic logo link for spaces using a solution view #241571.

featureEnforces the object_src 'none' directive in Kibana's Content Security Policy and introduces a new csp.object_src configuration option to control its behavior #241029.

featureImproves layout wrapping in the Overview and Notifications tabs on the Machine Learning Overview page #239113.

fixFixes missing accessibility announcements in Cases #240132.

fixFixes an issue where references were being lost in Links, Maps, and legacy Visualize panels when updating a dashboard #241893.

fixFixes layout issues for markdown content in small panels #240806.

fixShows warnings in the integrations synchronization UI when referencing other entities #241623.

fixAdds proxy SSL options to download sources #241115.

fixOmits system properties when syncing ingest pipelines #241096.

fixFixes Fleet policy name uniqueness not being consistently enforced across spaces when name or space changes occur #239631.

fixFixes the autocomplete suggestion of time series sources in TS commands after a comma #241402.

fixEnsures all authentication fields show up correctly when setting up an AI connector #240913.

fixFixes an issue with Agents and Playground icons not rendering correctly in the Elasticsearch solution side navigation when using dark mode #240475.

9.2.0 Oct 23, 2025 Release notes ↗

featureEnhanced navigation menu for spaces that use a solution view. The new navigation experience provides more workspace for your data with an improved collapsed mode, hover menus, and responsiveness.

featureNew Data Management menu. For easier access to data-related management tasks, you can now find Fleet, Index Management, Integrations, and Ingest Pipelines in a dedicated menu next to the Stack Management menu that previously hosted these pages.

featureKibana is now available in German in Beta. To get started, set the locale in your Kibana settings as follows: i18n.locale: de-DE. If you find any issues, please raise them on Github #236903.

featureAdds a table list view mode to the space selection screen for a more scalable design when a user has access to many spaces #229046.

featureEnables incremental human-readable case IDs #238555.

featureCreate case analytics indexes per solution per space #234125.

featureShows thumbnail image of attached case file #226004.

featureAdds a new Jira Service Management connector #235408.

featureAdds xpack.actions.email.recipient_allowlist alert action setting, which lets you specify a list of allowed email recipient patterns (to, cc, or bcc) that can be used with email connectors #220058.

featureAdds support for OAuth 2.0 authentication to the Webhook connector #218442.

featureAllows you to specify additional fields for the IBM Resilient connector #236144.

featureMaintenance windows are now generally available #233870.

featureAdds support for encrypted headers in the Webhook connector #233695.

featureAutomatically copies source data into the alerts-as-data documents for other Elasticsearch query rule types #230010.

featureYou can now add filters to maintenance windows based on alert fields from all solutions, without needing to select a category first #227888.

featureAdds the ability to configure index settings when importing geospatial files in Maps #232308.

featureAdds a new inline Markdown editor to edit your text without leaving the dashboard. #229191.

featureUpdates the toolbar popover for Metric charts, which is now called Appearance, with reorganized settings into clearer sections and new Primary position, Primary alignment, Secondary alignment, and Font weight settings #233992.

featureImproves ES|QL suggestions logic when an ES|QL visualization query changes #231767.

featureAdds a new Add menu to the toolbar that lets you populate your dashboard with visualizations, panels, sections, and controls. This menu replaces and combines the various buttons that previously allowed you to perform these actions #230324.

featureImproves perceived performance of dashboard flyouts #226052.

featureAdds the ability to Select all to Options list controls #221010.

featureAdds a toggle on the Elasticsearch output configuration page that grants agents permission to write to the logs and logs.* data streams #233374.

featureCompletes OTel configuration pipelines with an exporter #233090.

featureEnables feature to auto-install content packages when data is ingested for datasets that match the datasets defined in the packages' discovery fields #232668.

featureAdds a new MIGRATE action type for migrating agents to a different cluster #239556.

featureAdds the MIGRATE action to the SIGNED_ACTIONS set #228566.

featureAdds a Show agentless resources toggle on the Fleet > Settings page to allow for troubleshooting and diagnostics #237528.

featureUpdates the maximum supported version of package spec to 3.5 #235942.

featureEnables the installation of alerting_rule_template Kibana assets from packages; also enables a background task for reporting agent status changes in Fleet #235842.

featureAdds a filter on the Integrations page to show only agentless integrations #235686.

featureAdds support for a new url variable type in Fleet packages which provides better input validation of URLs in configurations #231062.

featureAdds support for a new duration variable type in Fleet packages which provides better input validation of duration strings in configurations #231027.

featureRenders the accordion for sample events on the integration overview page as collapsed by default #228799.

featureHides metrics data streams and packages on Logs Essentials projects #227842.

featureAdds a package rollback API #226754.

featureAdds support for the keep option in the Remove processor in ingest pipelines #225638.

featureAdds the Add / remove tags action on the agent details page #225433.

featureYou can now manage multiple data explorations simultaneously in Discover using tabs. Navigate between them seamlessly, duplicate them to build on previous queries, and save them into a single Discover session to retrieve your queries, filters, and configurations untouched at a later time #235150.

featureYou can now send long-running queries to the background. When a query runs in the background, you can perform other queries and tasks, then open it later from a new Background searches flyout to view cached results. This feature is in technical preview and disabled by default in this release.…

+53 more items in the release notes

9.1.10 Jan 13, 2026 Release notes ↗

fixAdds maximum character validation to the email connector params and configuration #246453.

fixAdds encoding to search terms in the Cases page to prevent decoding errors #247992.

fixFixes compound filters showing unsaved changes on dashboard load #247309.

fixFixes createAuditEvents always returning failure as the outcome #247152.

fixAdds case sensitivity to the index privileges fields on the Edit roles page #246069.

fixFixes the display of map view in Data Visualizer for small screen sizes #247615.

fixUnifies the flow for clients partially and fully authorized to saved objects, and applies the intersection of allowed and authorized lists #244967.

9.1.9 Dec 19, 2025 Release notes ↗

featureAdds the background task FleetPolicyRevisionsCleanupTask which removes excess policy revisions from the .fleet-policies index #242612.

featureThe API keys management page now defaults to showing personal API keys only #245261.

featureAdds a warning when deleting API keys currently used by alerting rules #243353.

fixFixes an issue that caused the Security alerts table not to update columns correctly when switching view modes #245253.

fixAdds consecutiveMatches to action context #244997.

fixFixes "now" and mixed-format date handling in the Share menu #245539.

fixFixes an issue with authentication when multiple OIDC providers are configured #243869.

fixFixes an ECS incompatibility with the kibana_started.elasticsearch.waitTime value in logs #245706.

fixFixes the serialization of meta.error in JSON layouts: if the error is an Error instance, only message, name, and stack are included. Other fields are no longer returned in the logs #244364.

fixHiding the alerts table popover no longer clears the cell selection in Anomaly Explorer #244183.

9.1.8 Dec 2, 2025 Release notes ↗

fixCaptures connector errors without interrupting the case creation flow. Issues with connectors can be resolved on the case details page #244188.

fixFixes pagination for the Alerts table, which was getting stuck on rule details pages #242275.

fixFetches tracked alerts without depending on the task state #235253.

fixFixes error that occurs when you deselect the (blank) option from the filter controls menu #242036.

fixUses long expiration for upgrading agents #243443.

fixFixes retrying agents stuck in auto-upgrade logic #243326.

fixAdds retry behavior for /api/fleet/agents when transient issues with Elasticsearch are encountered #243105.

fixFixes Docker image in the Add agent Kubernetes manifest #242691.

fixFixes Fleet policy name uniqueness not being consistently enforced across spaces when name or space changes occur #239631.

fixFixes ignore_above mapping for flattened fields #238890.

fixFixes the production build favicon's CSS specificity #243351.

fixFixes an issue on the Index management page where screen reader text was different from visible text #243802.

fixFixes an issue with keyboard focus getting trapped on pages using document preview #243791.

fixEnsures deleted text in AI connector or Inference endpoint forms is not sent as empty strings #244059.

fixFixes import and improves validation for Anomaly Detection and Data Frame Analytics jobs #242263.

9.1.7 Nov 11, 2025 Release notes ↗

securityFixes CVE-2025-68422: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…

securityFixes CVE-2025-37734: Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

featureAdds a feedback button to Anomaly Explorer and Single Metric Viewer #239883.

fixIn Cases, tables no longer flash when the page is loading #240155.

fixFixes an infinite loop issue occurring when the Investigation guide of a rule's details is too long #240472.

fixLabels in Maps' Create index flow now render with the default Use vector tiles scaling as soon as label styling is applied (or after saving), without requiring a scaling toggle #240728.

fixFixes an issue occurring when resetting a dashboard with unsaved changes after enabling timeRestore and setting a time range #239992.

fixShows warnings in the integrations synchronization UI when referencing other entities #241623.

fixAdds proxy SSL options to download sources #241115.

fixFixes Fleet policy name uniqueness not being consistently enforced across spaces when name or space changes occur #239631.

fixEnsures that the max_tokens parameter is correctly passed as expected when connecting to Anthropic #241212 & #241188.

fixRemoves the default fallback region for the Amazon Bedrock connector #241157.

fixEnsures that the inference endpoints list loads properly even when using a custom inference provider #240189.

9.1.6 Oct 23, 2025 Release notes ↗

securityFixes CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi…

featureReplaces the ?showAgentless query param with a local storage setting called fleet:showAgentlessResources, which can be toggled from the Fleet settings page. When enabled, agentless agents and policies are visible in the Fleet UI #237528.

featureEnhances error message by explaining why the role is considered malformed #239098.

fixFixes an issue that prevented you from deleting unsaved dashboard changes after you had enabled the timeRestore setting and selected a time and date using the date picker #239992.

fixFixes error that occured when you selected a blank value in the options list #239791.

fixFixes an issue in Lens that incorrectly assigned unsaved, ad-hoc dataview references #239431.

fixFixes metric color assignment when breakdown and a max dimension are defined in Lens #238901.

fixEnsures adhoc dataviews from ES|QL charts aren't being filtered out in the KQL search bar #238731.

fixFixes an issue that occured during an integration policy upgrade that prevented the new package global variables from being included and stale variable references from being removed #238542.

fixEnsures that the combined filters are considered when selecting the correct fields for the query while the courier:ignoreFilterIfFieldNotInIndex advanced setting is enabled #238945.

fixFixes visual issues with the document metadata popup that happened when the document ID was too long. Also adds a tooltip and copy button to improve the user experience #239768.

9.1.5 Oct 6, 2025 Release notes ↗

securityFixes CVE-2025-25018: Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

securityFixes CVE-2025-25009: Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

featureRenames Fleet Server SSL options for clarity in the Add a Fleet Server flyout #236887.

fixRolls over the reporting data stream if its template version is newer than the version in the data stream's mappings #234119.

fixFixes an issue where the dashboard title would not get updated in the breadcrumb when edited from the list of dashboards #236561.

fixUpdates dashboards to wait until controls are ready before rendering panels to prevent a double fetch of data #237169.

fixFixes an issue with the Lens table's column sort order being different in the dashboard and the exported CSV #236673.

fixFixes text kerning issues in PDF/PNG exports of dashboards and visualizations #235516.

fixFixes incorrect copying of SSL settings to the Fleet Hosts section of generated Agent policies #236788.

fixValidates the Logstash pipeline ID at the Kibana API level #236347.

fixAdds a unique count to improve accuracy of the number of transforms on the integrations overview page #236177.

fixFixes malformed synthetics package policies #236176.

fixClears sort by timestamp when navigating from classic to ES|QL mode #235338.

fixFixes sizing issues with the Actions column header #235227.

fixAllows xpack.spaces.defaultSolution to be configured through environment variables for Docker deployments #236570.

fixOmits fields that should not be included in datafeed preview requests when testing custom URLs in anomaly detection jobs #234709.

fixImproves trained model performance by adding filters to the request to fetch all index settings #237072.

fixHides the show forecast checkbox when selecting a new job in the Single Metric Viewer #236724.

fixMakes alerts visible in Anomaly Explorer to all Machine Learning-only users regardless of where they create rules #236289.

fixFixes the Job details flyout on the Analytics Map page #236131.

fixFixes rendering of the dashboard panel in PDF reporting for the Anomaly Swim Lane #235475.

fixLimits log rate analysis category requests to reduce msearch usage #235611.

fixAdds the managed field to the data views response schema to prevent the public API call from failing #236237.

fixAdds the timeFieldName field to the data views response schema to prevent the public API call from failing #235975.

fixFixes privilege requirements when reindexing indices through Upgrade Assistant. Previously, the superuser role was required, but now the cluster: manage and all privileges are sufficient #237055.

fixAdds the ability to do partial matches and searches in the API keys section #221959.

fixAdds search functionality to the Query rules details page #232579.