Kibana 9.2.0 → 9.4.3

21 releases · 0 breaking changes · 74 security fixes · 41 advisories fixed

74security0breaking0deprecated94feature301fix

Is 9.2.0 affected? · What changed up to 9.5.6

Vulnerabilities fixed by this upgrade

4.3 CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…
6.5 CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…
6.5 CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…
7.3 CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…
6.3 CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…
7.3 CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…
6.5 CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…
6.5 CVE-2026-33465 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could…
7.3 CVE-2026-72677 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…
4.3 CVE-2026-49096 Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…
6.5 CVE-2026-56151 Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…
6.5 CVE-2026-49087 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…
6.5 CVE-2026-49095 Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…
7.7 CVE-2026-42398 Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn…
6.5 CVE-2026-42399 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…
6.5 CVE-2026-42400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…
6.5 CVE-2026-33464 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…
4.1 CVE-2026-42401 Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…
4.6 CVE-2026-33462 A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…
5.3 CVE-2026-33463 Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…
6.5 CVE-2026-33459 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…
7.7 CVE-2026-4498 Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…
7.7 CVE-2026-33461 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…
4.3 CVE-2026-33460 Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…
6.5 CVE-2026-26939 Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s…
6.5 CVE-2026-26940 Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…
6.5 CVE-2026-26937 Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
6.5 CVE-2026-26934 Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC…
6.5 CVE-2026-26935 Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
4.9 CVE-2026-26936 Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
6.5 CVE-2026-0543 Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…
6.5 CVE-2026-0528 Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…
6.5 CVE-2026-0530 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…
6.5 CVE-2026-0531 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…
7.2 CVE-2025-68385 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…
4.3 CVE-2025-68386 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…
6.1 CVE-2025-68387 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…
6.5 CVE-2025-68389 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…
4.3 CVE-2025-68422 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This…
5.4 CVE-2025-37732 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…
4.3 CVE-2025-37734 Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio… in 9.4.3
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.4.3
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.4.3
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.4.3
security Fixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… in 9.4.3
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.4.3
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.4.3
security Fixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us… in 9.4.3
security Fixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under… in 9.4.3
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.4.2
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.4.2
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.4.2
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.4.2
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.4.2
security Fixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper… in 9.4.0
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.3.8
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.3.8
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.3.8
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.3.8
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.3.8
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.3.8
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.3.8
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.3.8
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.3.8
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.3.8
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.3.8
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.3.8
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.3.7
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.7
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.3.6
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.3.6
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.3.6
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.3.6
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.3.5
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.3.5
security Fixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.5
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.3.5
security Fixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… in 9.3.5
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.3.5
security Fixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… in 9.3.5
security Fixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… in 9.3.5
security Fixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… in 9.3.5
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.3.5
security Fixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… in 9.3.5
security Fixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… in 9.3.4
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.3.3
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.3.3
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.3.3
security Fixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server… in 9.3.3
security Fixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest… in 9.3.3
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.3.3
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.3.2
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.3.2
security Fixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could… in 9.3.0
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.2.8
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.2.8
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.2.8
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.2.8
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.2.8
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.2.7
security Fixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s… in 9.2.6
security Fixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC… in 9.2.6
security Fixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 9.2.6
security Fixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) in 9.2.5
security Fixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). in 9.2.5
security Fixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… in 9.2.4
security Fixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… in 9.2.4
security Fixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… in 9.2.4
security Fixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… in 9.2.4
security Fixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… in 9.2.3
security Fixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… in 9.2.3
security Fixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… in 9.2.3
security Fixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… in 9.2.2
security Fixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… in 9.2.2

Every release in between

9.4.3 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio…

securityFixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…

securityFixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…

securityFixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc…

securityFixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…

securityFixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…

securityFixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…

securityFixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us…

securityFixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under…

featureAdds xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control the Elasticsearch index.mapping.total_fields.limit on .alerts-* indices, index templates, and component templates. Raise this above the current alert mapping field count to prevent mapping-update failures…

fixFixes ES|QL query escaping in the Dashboard skill's visualization config generation, ensuring patterns such as GROK retain the correct escape levels when queries are embedded as JSON #272493.

fixFixes the Stack Alerts page triggering two search cycles on initial load when filter controls are present, which could cause a brief flash of unfiltered results #271441.

fixFixes dashboard filters not being applied after collapsing a section that was expanded on initial load #272751.

fixFixes dashboards with panel or filter arrays that exceed schema size limits failing to load, by removing the array-size ceiling from internal read requests #271326.

fixImproves dashboard load resilience by validating each state key independently, dropping invalid panels, filters, or queries with warnings rather than failing the entire load #270300.

fixIncreases the maximum number of combined panels, sections, and controls on a dashboard from 100 to 1,000 #272931.

fixFixes Save and return not working for Maps visualizations opened from the Visualize library #274002.

fixFixes a stale closure in the Canvas autoplay timer that could skip pages after slides are added or removed #268398.

fixDisables the experimental Defer loading panels below "the fold" dashboard setting (labs:dashboard:deferBelowFold) because enabling it can cause some dashboards to fail to load. The option remains in Advanced Settings but has no effect from this version. It might be enabled again in a future…

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixImproves POST /api/fleet/setup performance for deployments with many configured outputs by fetching only the required outputs instead of decrypting all saved outputs on each call #273848.

fixOptimizes the agent policies list endpoint (withAgentCount=true) to compute agent counts using a single aggregation instead of multiple queries per policy, greatly improving response time for large deployments #272429.

fixPrevents the agent version check from hanging indefinitely in air-gapped or firewall-restricted environments, and adds xpack.fleet.productVersionsApiTimeoutMs (default: 60 s) to control the request timeout #272715.

fixFixes variable leakage and duplication across policy templates in input packages that define multiple policy templates #273364.

fixIncludes input packages in the Integrations Signal type filter #272585.

fixFixes security rule names not displaying in the integration Assets accordion #272089.

fixFixes the agent logging level dropdown not updating after clicking Reset to policy on the agent Settings tab #271964.

fixFixes broken asset references in the integration Assets tab when an integration is reinstalled or upgraded from a different Kibana space #271800.

fixFixes per-integration output overrides for OpenTelemetry (OTel) integrations, and now raises a validation error when an unsupported output type is assigned instead of failing silently #270487.

fixFixes null and undefined field values in the ES|QL document summary column incorrectly counting toward the discover:maxDocFieldsDisplayed limit, which caused fields with real values to be hidden #273610.

fixFixes the Extend action icon in the Background searches panel being invisible in dark mode #272754.

fixFixes Discover session panels in dashboards failing to load after Copy to Spaces or import when the target space already contains remapped sessions #272610.

fixFixes a regression where KQL autocomplete suggestions stopped working in the ES|QL editor #273931.

fixFixes editing of object fields in the ES|QL lookup index editor when using dot-notation column names #273303.

fixAdds notifications.connectors.default.email as a Docker environment variable #272761.

fixFixes user profile retrieval in reverse proxy run_as configurations, ensuring the nav bar displays the effective user's avatar and name rather than the proxy user's #271314.

fixFixes product documentation installation timing out when the ML inference endpoint scales up from zero replicas (cold-start), and improves error messages when installation fails #270005.

fixLogs Dev Tools Console requests through the elasticsearch.query debug logger (method, path, and response status; request bodies are not included since Console streams them), and adds support for URL path prefixes in elasticsearch.hosts for Console proxy requests #271562.

fixFixes workflow executions that become orphaned from Task Manager now being cancelled immediately rather than waiting indefinitely for an asynchronous cancel #272672.

9.4.2 May 28, 2026 Release notes ↗

securityFixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…

securityFixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…

securityFixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…

securityFixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…

securityFixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…

featureImproves the Add inference endpoint and Edit inference endpoint flyouts with clearer titles, a footer Save button, task type descriptions in the selector, always-visible endpoint ID and API reference fields, and inline validation for required fields #262143.

fixFixes an issue that caused rules with large action parameter payloads to fail when saving or executing #269467.

fixFixes case workflow templates resolving from the wrong owner #268719.

fixFixes phrase search in the All Cases view #266827.

fixFixes the email connector to reject malformed email addresses (for example, local parts or domain labels with leading or trailing hyphens) that mail servers would reject, preventing unnecessary SMTP connection attempts #268496.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and space URL prefixes, preventing 404s on connector detail tabs and after creation #269571.

fixFixes the links panel transform to remove an unsupported enhancements property #270230.

fixFixes the Lens API so XY charts with legends at the top or bottom return the correct configuration #268729.

fixFixes the Lens Visualization API rejecting rank_by with operation: "count" on terms buckets when no field is specified, so Count can rank by all documents without a field #268620.

fixFixes the Visualization API to correctly show default datatable colored badges #268425.

fixFixes gauge chart min, max, and goal configuration to reject unsupported reference-based metric operations (moving_average, differences, cumulative_sum, counter_rate) that require a date histogram #268168.

fixParses top-level elasticsearch fields in integration packages on upgrade or reinstall #269080.

fixFixes the agent enrollment Confirm incoming data step timing out for integrations that ingest backdated data by checking event.ingested instead of @timestamp #268224.

fixPreserves the expanded document selection after refresh when comparing documents in Discover #268328.

fixAllows null in CASE() expressions combined with other types #269051.

fixFixes missing modal and popover labels for screen readers across Stack Management UIs #269652.

fixFixes File upload not disabling data view creation when the user lacks data view creation capabilities #268167.

fixMakes the with block optional in workflow YAML for connector steps that have no required parameters #269047.

9.4.1 May 12, 2026 Release notes ↗

fixFixes empty rule type fields, such as kibana.alert.reason, on active alert documents when a delayed alert graduates to active during a flapping hold without an executor report. #266012

fixFixes a critical validation failure that occurred when dashboard controls had null titles. Control titles are now converted to undefined during transforms, allowing validation to pass #268220.

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the ES|QL control edit flyout when editing an existing query-based control #267605.

9.4.0 May 5, 2026 Release notes ↗

securityFixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…

featureMakes maximumCasesToOpen a runtime property #259255.

featureAdds an auto-push case option to the case connector #249251.

featureExposes the maximumCasesToOpen parameter in the case action connection #247990.

featureAdds additional workflow steps #256922.

featureAlert deletion is now generally available #247465.

featureUpdates Test tool flyout to support datetime picker #249549.

featureSimplifies the ES|QL test tool parameter types #249855.

featureExposes configuration_overrides in agent_builder/converse API #249256.

featureAdds support for array parameter types in ES|QL tools #250386.

featureMigrates the flyout to a sidebar #252918.

featureAdds server-side support for user-created skills in Agent Builder #252493.

featureAdds agent and tools RBAC sub features #254464.

featureAgent Builder's default agent is no longer read-only and can now be customized per Kibana space #256333.

featureAdds user-created skills to Agent Builder #252221.

featureAllows Agent Builder to detect outdated attachments and lets users refresh them into the next message #257658.

featureAllows ES|QL generation to search index patterns #253492.

featureAllows agents to run one or more workflows before each execution, enabling prompt modifications or conditional abort #252452.

featureAdds audit logging for agent and tool create, update, and delete actions #252143.

featureAdds support for the region parameter to the Bedrock Connector #252956.

featureAdds a Jina Reader data source connector #247527.

featureAdds a Jira Cloud data source connector #251345.

featureAdds a SharePoint Online data source connector #251544.

featureAdds a ServiceNow data source connector #252430.

featureAdds a Microsoft Teams data source connector #252465.

featureAdds a Tavily data source connector #252717.

featureAdds a Google Calendar data source connector #252740.

featureAdds a Slack data source connector #252972.

featureAdds an Amazon S3 data source connector #253753.

featureAdds a Salesforce data source connector #254303.

featureAdds a Zendesk data source connector #254739.

featureAdds a Firecrawl data source connector #255004.

featureAdds a 1Password data source connector #255076.

featureAdds a PagerDuty data source connector #255154.

featureAdds a Zoom data source connector #255174.

featureAdds a Figma data source connector #255322.

featureAdds a Gmail data source connector #255565.

featureAdds an AWS Lambda data source connector #256150.

featureAdds a Confluence Cloud data source connector #256508.

featureAdds a Google Cloud Storage data source connector #257374.

+397 more items in the release notes

9.3.8 Jul 21, 2026 Release notes ↗

securityFixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th…

securityFixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…

securityFixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…

securityFixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…

securityFixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…

securityFixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…

securityFixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c…

securityFixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ…

securityFixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…

securityFixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…

securityFixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…

securityFixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

fixPrevents the Task Manager invalidate task from invalidating an API key that is still shared by other live tasks, which caused those tasks to fail with a security exception #275157.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes escape_string values that contain double quotes from corrupting surrounding agent policy YAML #279391.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes Console autocomplete so nested object fields and multi-fields in index mapping bodies suggest mapping options again #278508.

fixFixes Console requests that combine comments with triple-quote strings failing with x_content_e_o_f_exception #277259.

fixFixes a Windows-specific code editor issue that could corrupt multi-line edited text after refresh #277007.

fixFixes the Console Copy button silently failing to copy response output #276365.

fixFixes Console autocomplete matching an incorrect API endpoint when a URL matches both a literal path and a parameterized path #276239.

fixImproves Console ES|QL source autocomplete by reusing a fresh source list instead of refetching it on every keystroke #275535.

fixPrevents removing all spaces from a machine learning job or trained model through the spaces update APIs #276490.

fixRestricts the clear audit messages API so users can only clear messages for jobs they can access, and only against valid notification indices #276419.

fixFixes a crash in ES|QL query correction when an LLM generates a multi-line WHERE clause #277153.

9.3.7 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

fixFixes case pushes only stamping a subset of attachments, which caused the alert count comment to be duplicated in the external system on every push #274451.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes Canvas autoplay not advancing past the first page #272619.

fixFixes the agentless enrollment flyout for content connector integrations to show a connector configuration link instead of waiting for incoming data that cannot arrive until the connector is set up #274832.

fixImproves POST /api/fleet/setup performance for deployments with a large number of configured outputs by no longer decrypting every output on each call #273848.

fixFixes integration category filters sticking in place when scrolling the Integrations page on mobile #273499.

fixFixes a crash in the Integrations view when a package has no icon #273191.

fixFixes the ES|QL document summary column counting null values against the displayed field limit, which could hide fields with real values behind an "and X more fields" label #273610.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixFixes the Files plugin blob download to return the requested file type #274783.

fixFixes Dev Tools Console autocomplete in query filter context to suggest query DSL instead of the obsolete Elasticsearch 1.x filter DSL #272907.

9.3.6 Jun 23, 2026 Release notes ↗

fixFixes the Stack Alerts page fetching alerts twice on initial load by deferring table rendering until filter controls have finished initializing #271441.

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixFixes a stale closure in the Canvas autoplay timer that could advance to the wrong slide when slides were added or removed while autoplay was running #268398.

fixOptimizes GET /api/fleet/agent_policies (with withAgentCount=true) to compute agent counts in a single bucketed aggregation instead of multiple queries per policy, significantly reducing response time for deployments with many agent policies #272429.

fixFixes integration package reinstalls and upgrades performed from a space different from the original installation space incorrectly bucketing Kibana asset references, causing the Assets tab to display raw UUIDs instead of asset titles #271800.

fixFixes variable leakage and duplication between policy templates in input packages that define multiple policy templates #273364.

fixFixes security rule names not displaying in the integration Assets accordion when the rule object has no title field #272089.

fixFixes the agent logging level dropdown on the Settings tab not updating after Reset to policy is applied, so the displayed level now stays in sync with Fleet-polled agent metadata #271964.

fixFixes the Extend action icon in the Background searches row actions menu being invisible in dark mode by rendering it as an inline SVG that inherits the surrounding icon color #272754.

fixFixes slow KQL parsing caused by long runs of whitespace by improving keyword-adjacent whitespace handling in the KQL grammar #266512.

fixAdds notifications.connectors.default.email to the list of supported Docker environment variables #272761.

9.3.5 May 28, 2026 Release notes ↗

securityFixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…

securityFixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…

securityFixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…

securityFixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…

securityFixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…

fixFixes Elastic Stack rule upgrades failing when rule action params values exceed Elasticsearch field size limits by adding ignore_above: 4096 to the actions.params mapping #269467.

fixFixes alert index template updates failing when auto-increasing total_fields.limit because system-managed read-only fields were included in the update request #262534.

fixFixes phrase search in the All Cases view so quoted queries match exact phrases and unquoted queries match individual terms #266827.

fixFixes the email connector to reject malformed email addresses (for example, addresses with leading or trailing hyphens in the local part or domain labels) that mail servers would reject, preventing unnecessary SMTP connection attempts. Existing connectors saved with invalid addresses will fail…

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the control edit flyout when editing an existing query-based variable control #267605.

fixFixes agent policy background tasks failing with a parse_exception by sorting agent policies on updated_at instead of the non-existent created_at field #267285.

fixFixes a race condition during async integration knowledge base installation that could clear installed_es asset references for input packages and leave the Assets tab blank #266841.

fixUses password fields instead of cleartext inputs for multi-value secret variables in integration policy forms #266823.

fixFixes an issue in Discover's ES|QL mode so the expanded document flyout correctly stays on the same result after a refresh when METADATA _index, _id is available, and shows the original document without pagination when that result is no longer in the refreshed set #268328.

fixEnsures CSV exports from Discover use the absolute time range for the current session so exported data matches what you see on screen #255005.

fixFixes date conversion in the file sharing service #265131.

fixFixes Anomaly Detection chart markers in the Single Metric Viewer so sparse data points with a single value in the chart time range remain visible without hovering #263632.

fixFixes the IP Location processor in Ingest pipelines saving the wrong database_file and showing duplicate selections when a local database filename matches a managed database label #265740.

fixAdds accessible names to modals and popovers across Stack Management pages to improve screen reader support #269652.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and Kibana space prefixes, resolving 404 errors on connector detail tabs and the post-creation Manage connector action #269571.

fixPrevents each keystroke in the Advanced Settings search bar from adding a browser history entry, so the back button navigates away from the page in one step #266278.

fixFixes query rules API routes to limit the maximum size of arrays accepted in request data #265495.

fixFixes the Search Applications document explorer rendering HTML markup from field .snippet values #265319.

9.3.4 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…

featureRemembers the pagination state when navigating back from an edit on the Users page, instead of always returning to page 1 and resetting the search #261152.

fixFixes an issue where Stack alerts sent recovery notifications but remained active in Kibana instead of transitioning to recovered #261012.

fixAdds the application/x-zip-compressed MIME type as an accepted value for case file attachments #262414.

fixFixes the "Failed to check if maintenance windows are active" error #261048.

fixFixes YAML file downloads being truncated at the first # character by properly URL-encoding the content #264083.

fixFixes package policy count filters to correctly identify non-latest revisions #263717.

fixOnly auto-installs content packages that are newer than the installed version #262509.

fixFixes Fleet Server diagnostic bundles failing to download when elasticsearch.compression is enabled #262394.

fixFixes missing sort-state announcements for screen readers in the Ingest pipelines list #262226.

fixFixes focus management for the Learn more link #261902.

fixFixes screen reader announcements for the Define as JSON toggle #261896.

fixFixes screen readers announcing duplicate row indices in the Ingest pipelines list #261369.

fixFixes the inference processor form to accept the input_output configuration shape #260517.

fixFixes screen readers announcing icon labels twice in the Ingest pipelines list #259185.

fixFixes screen readers incorrectly combining button announcements on the Create Pipeline page #261603.

fixFixes stale screen reader announcements in code boxes #261921.

fixFixes the transforms detail summary to show all source_index entries when source_index is an array #261875.

fixFixes screen readers announcing search template options twice #261585.

fixFixes screen readers announcing duplicate row indices on the data streams table #261366.

fixFixes screen readers announcing icon labels twice in the Edit policy flyout #261324.

fixFixes screen readers announcing policy actions tooltip text twice in the index lifecycle policies list #261322.

fixFixes screen readers announcing copy button labels twice #261311.

fixFixes screen readers announcing grey color badge text twice in the transforms list #261307.

fixFixes screen readers not announcing invalid field validation errors #260673.

fixResets the time field when the updated index pattern does not include it #262001.

fixFixes ES|QL multi-value filtering with STATS #260998.

fixAdjusts the API Key flyout width #263858.

fixAllows space colors to be cleared, falling back to the default #261826.

fixFixes screen readers announcing data stream and index options twice in the Create policy and Restore snapshot selectable lists #261786.

fixFixes policy buttons to have distinguishable names for screen readers #261313.

fixFixes the single metric chart in Anomaly Explorer not showing anomaly actions correctly #263925.

fixUpdates the hono and @hono/node-server dependencies #263794.

fixFixes execution tree clipping when foreach has many iterations #253576.

9.3.3 Apr 8, 2026 Release notes ↗

securityFixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…

securityFixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…

securityFixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…

securityFixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server…

securityFixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest…

securityFixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…

fixFixes Webhook Connector accessTokenUrl validation #258290.

fixAdjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.

fixFixes Canvas library embeddables failing to load when savedObjectId is present without saved object references #257779.

fixFixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.

fixFixes Add from library in Canvas creating incorrect embeddable state #257261.

fixFixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes are saved #256984.

fixImproves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.

fixFixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.

fixFixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies are also counted #258387.

fixRestores keyboard focus to the Create a transform button on the Transforms page #258095.

fixEnhances screen reader notifications for bulk actions in Index Management tables, providing live announcements when the bulk actions menu becomes visible or hidden #257089.

fixFixes the query rules UI rejecting case variants as duplicate values #259506.

fixFixes only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.

fixPrevents creating incompatible inference endpoints when adding a semantic_text field in the Index Management mappings editor #256586.

fixFixes the anomaly swim lane dashboard panel not refreshing #259962.

fixFixes a console error when opening the data frame analytics jobs list #258591.

fixAdds aria labels to job wizard combo boxes #258509.

9.3.2 Mar 19, 2026 Release notes ↗

securityFixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn…

securityFixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…

featureAdds Gemini 2.5 Flash Lite, Claude 4.5 Haiku, and Claude 4.6 Sonnet models to preconfigured connectors #253109.

fixFixes a bug in the platform.core.search tool and index_search tool type where nested fields were ignored when searching for matching documents #255914.

fixFixes MCP connectors ignoring the proxy and SSL configuration from the actions plugin (xpack.actions configuration property) #255813.

fixFixes a problem generating a report with multi-page Canvas workpads #255022.

fixFixes a blank page appearing at the end of PDF exports when using the Print format option with an even number of dashboard visualizations #254957.

fixImproves handling of 204 responses #251090.

fixFixes an issue where embedded panels in Canvas workpads could lose their saved object references, causing panels to fail to load #252191.

fixFixes the Add from library action adding incorrect embeddable state #257261.

fixFixes Lens transforms #257224.

fixFixes an issue where dashboard panels could get stuck in an infinite loading state after an error instead of showing error messages #257188.

fixFixes Maps failing to load when the stored time filter contained a quick mode value #255178.

fixFixes the unenroll task and adds an FTR test #255726.

fixFixes the incorrect installation of assets #254923.

fixFixes glitchy rendering in the Attributes tab #255173.

fixFixes the spaces list displaying No spaces match text on load #255654.

fixFixes the embeddable console auto-closing on chrome or overlay clicks #253382.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixAdds waitFor for the privilege button #255094.

fixFixes an issue where saving a dashboard included access control features when a user profile was not available #255065.

fixFixes screen reader announcements for flyouts #256409.

fixImproves name announcement in the index mode modal #256392.

fixFixes an issue in Dev Tools Console where syntax highlighting broke when queries contained accented or non-ASCII characters #255649.

fixFixes an issue in Dev Tools Console where closing nested braces broke syntax highlighting for subsequent elements #255426.

fixChanges the Run in Console button type #256455.

fixFixes Search Playground routes to limit the maximum size of arrays #255881.

fixFixes focus behavior when there are errors in the connector flyout form #255770.

fixAdds server-side API key generation #256083.

9.3.1 Feb 26, 2026 Release notes ↗

featureAllows integration rollback even if all package policies are not on an upgraded version #253646.

featureAdds a dynamic default connector to GenAI settings #252861.

featureAdds missing ES|QL commands and functions documentation for inference tasks #249089.

fixFixes a bug with PagerDuty where setting the Custom details field causes rules to fail #253683.

fixAdds external reference IDs to the attached documents check when a case is selected #253107.

fixFixes rule execution failing due to null execution UUIDs #252618.

fixImproves handling of 204 responses #251090.

fixFixes AI Connector form fields incorrectly resetting to default values when cleared with backspace #251095.

fixUpdates connector description terminology to reference "pre-configured AI connectors" #250649.

fixFixes layer editor scrolling in the full Lens editor #253247.

fixFixes runtime_mappings being ignored or overridden in Vega specs when defined in data[].url.body #253560.

fixFixes an issue where an agent rolled back after an upgrade could not be upgraded again in Fleet UI #253850.

fixFixes the handling of missing values #251892.

fixStrips system-managed date fields from ingest pipelines before PUT requests #252579.

fixFixes Stack Monitoring breadcrumb when in solution view #249751.

fixFixes "today" and "this week" filters for Log Rate and Pattern Analysis embeddables #252925.

fixFixes word break in Anomaly Detection page titles #250058.

fixFixes autocomplete not working in embedded console #253306.

fixFixes an issue loading the doc count in index management when viewing larger page sizes with long index names #252422.

fixFixes a validation error for AI pipeline suggestions with empty grok patterns #251113.

fixFixes the homepage throwing errors when the license level is below Enterprise #251484.

fixReduces background polling on the Index Details page to avoid unnecessary API requests #251446.

fixFixes links being visible on Search homepage when the user doesn't have access #251437.

fixAdds datemath support to the KQL evaluator #252840.

9.3.0 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could…

featureElastic Agent Builder is now generally available. It is enabled by default in Elasticsearch solution environments, and you can opt in to Agent Builder and its AI Agent chat experience in Observability and Security solution environments. Learn how to get started.

featureSupports searching for report schedules by title and creator #243841.

featureProvides fields for specifying cc and bcc recipients, the subject line, and the message for scheduled report email notifications #242922.

featureEnables incremental human-readable case IDs #238555.

featureAdds option to delete report schedules #238197.

featureAlert cleanup is now generally available #247465.

featureAdds search to the new Attachments tab in cases #246265.

featureAdds support for searching rules by their actions' params using the API #246123.

featureScheduled reports are now generally available #245882.

featureThe Slack connector can now be configured to send messages to any channel using channel names #245423.

featureImproves search on the case management page #245321.

featureAdds option to enable disabled report schedules #244202.

featureDisable flapping per rule - schema only changes #243855.

featureCentralizes tabs for different attachement types under the new Attachments tab in cases #243708.

featureAdds a date time picker to the cases management page to help you find cases that were created during a specific time range #243409.

featureAdds option to edit report schedules #241928.

featureImproves UI for specifying additional fields for IBM Resilient action #238869.

featureMakes Agent ID the default observables type #238533.

featureAdds kibana.alert.index_pattern to all Stack alerts. This change doesn't affect detection alerts #239450.

featureElastic will regularly be adding new AI models from 9.3 onwards which will appear as pre-configured AI connectors in Kibana. Refer to the Elastic Inference Service page for more details.

featureAdds Groq to the list of available providers for the Inference/AI Connector and for Inference endpoint creation #244962.

featureIntroduces a Brave Search connector #245329.

featureThe webhook connector now supports the following HTTP request methods: POST(default), PUT, PATCH, GET, and DELETE #238072.

featureAdds new preconfigured connectors and updates existing ones #242791.

featureAdds a new temperature parameter to AI Connector and to OpenAI, Bedrock, and Gemini connectors #239806.

featureAdds support for headers in the OpenAI integration #238710.

featureDashboards now support ownership and "write_restricted" mode. You can now keep dashboards publicly editable or in a write-restricted state until they are ready to be published, giving you more control over who can edit your dashboards, regardless of broader space permissions #224552.

featureAdds support for chaining variable controls. You can now set up variable controls to depend on the values selected for another variable control #242909.

featureAdds basic filtering support for interactions with ES|QL charts #243439.

featureRemoves the Supporting visualization section heading from the Primary Metric editor. All configuration options remain fully accessible in the same location under Appearance #245979.

featureReorganizes and renames color settings in the Primary Metric dimension editor. For numeric metrics, the "Color by value" and "Color mapping"/"Color" settings are now located under the "Background chart" field. The settings have been renamed as follows: "Color by value" is now "Color mode", and…

featureIn dashboard visualization in-line editing and Lens workspace, the 'Appearance', 'Titles and text', 'Axis', and 'Legend' settings have been moved from a popover into a dedicated flyout panel #240804.

featureMoves the Lens visualization toolbar from the workspace section to the configuration panel #239879

featureMoves the Save as and Reset options under the top nav Save button when the dashboard is in edit mode #237211.

featureThe Lens configuration panel has been redesigned to display layers as tabs instead of vertically stacked panels. Layer actions (clone, remove, save) are now accessible through a menu in each tab, improving the editing experience when working with multiple data layers, annotations, and reference…

featureEnables integration knowledge generation by default and adds a UI setting that allows you to opt out of the integration knowledge indexing #245080.

featureEnables rolling back integrations to the previously installed version #240761.

featureAdds capability for rolling back a recent upgrade of a Fleet-managed Elastic Agent using Fleet UI or API #247398, #249416.

featureAdds functionality for removing root privilege from Fleet-managed agents if applicable #237790.

+197 more items in the release notes

9.2.8 Apr 8, 2026 Release notes ↗

fixFixes Webhook Connector accessTokenUrl validation #258290.

fixAdjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.

fixFixes Canvas library embeddables failing to load when savedObjectId was present without saved object references #257779.

fixFixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.

fixFixes Add from library in Canvas creating incorrect embeddable state #257261.

fixFixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes were saved #256984.

fixEnsures the log level from the assigned policy is used when an agent configuration doesn't mention one #259425.

fixImproves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.

fixFixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.

fixFixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies were also counted #258387.

fixRestores keyboard focus to the Create a transform button on the Transforms page #258095.

fixFixes the query rules UI rejecting case variants as duplicate values #259506.

fixPrevents only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.

fixFixes the anomaly swim lane dashboard panel not refreshing #259962.

9.2.7 Mar 19, 2026 Release notes ↗

fixFixes a blank page appearing at the end of PDF exports when using the Print format option with an even number of dashboard visualizations #254957.

fixImproves handling of 204 responses #251090.

fixFixes an issue where embedded panels in Canvas workpads could lose their saved object references, causing panels to fail to load #252191.

fixFixes an issue where dashboard panels could get stuck in an infinite loading state after an error instead of showing error messages #257188.

fixFixes the unenroll task and adds an FTR test #255726.

fixFixes the incorrect installation of assets #254923.

fixFixes the spaces list displaying No spaces match text on load #255654.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixAdds waitFor for the privilege button #255094.

fixImproves name announcement in the index mode modal #256392.

fixFixes an issue in Dev Tools Console where syntax highlighting broke when queries contained accented or non-ASCII characters #255649.

fixFixes an issue in Dev Tools Console where closing nested braces broke syntax highlighting for subsequent elements #255426.

fixFixes Search Playground routes to limit the maximum size of arrays #255881.

fixAdds server-side API key generation #256083.

fixFixes glitchy rendering in the Attributes tab #255173.

fixFixes EQL sequence document merging to treat dot and nested notation the same #254830.

9.2.6 Feb 26, 2026 Release notes ↗

securityFixes CVE-2026-26939: Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s…

securityFixes CVE-2026-26934: Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC…

securityFixes CVE-2026-26935: Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

fixFixes rule execution failing due to null execution UUIDs #252618.

fixFixes runtime_mappings being ignored or overridden in Vega specs when defined in data[].url.body #253560.

fixFixes the handling of missing values #251892.

fixStrips system-managed date fields from ingest pipelines before PUT requests #252579.

fixReduces background polling on the Index Details page to avoid unnecessary API requests #251446.

9.2.5 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-26937: Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)

securityFixes CVE-2026-26936: Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).

fixFixes timestamp override for ES|QL CSV scheduled reports with relative time ranges #248169.

fixFixes an issue with dashboard PDF/PNG reports being cut off at the end when the dashboard has a markdown panel #249644.

fixFixes an issue with the "Search entire time range" option that could exclude some results if the time field was set to date nanos #248495.

fixFixes an issue where document viewer tabs were unnecessarily re-mounting on every refresh, leading to degraded performance #248203.

fixFixes an issue causing query drafts to be lost when switching between tabs without running the query first in ES|QL mode #247968.

fixFixes an issue with the Share menu where all time ranges were being shared as absolute #248804.

fixFixes an issue with certain properties causing failures when adding a policy to an index template #249168.

fixFixes an issue with duplicated managed ILM policies still appearing as managed #248586.

fixFixes Stack Monitoring Recent Log Entries' timestamps to respect Kibana's time zone setting (dateFormat:tz) #249016.

fixFixes the breadcrumb when navigating to the Stack Monitoring page while using a solution view #249751.

fixFixes occasional file preview corruption during file uploads #250532.

fixUpdates Packetbeat DNS tunneling datafeed to include runtime mappings #249317.

9.2.4 Jan 13, 2026 Release notes ↗

securityFixes CVE-2026-0543: Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires…

securityFixes CVE-2026-0528: Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay…

securityFixes CVE-2026-0530: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r…

securityFixes CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker…

fixAdds maximum character validation to the email connector params and configuration #246453.

fixAdds encoding to search terms in the Cases page to prevent decoding errors #247992.

fixUpdates total events in Elasticsearch document when attaching an event to a case #247996.

fixFixes compound filters showing unsaved changes on dashboard load #247309.

fixFixes the default app state handling when detecting unsaved changes #246664.

fixFixes an issue with ES|QL tabs not loading properly #246941.

fixFixes createAuditEvents always returning failure as the outcome #247152.

fixAdds case sensitivity to the index privileges fields on the Edit roles page #246069.

fixDisables field statistics for ES|QL with TS command #247641.

fixFixes the display of map view in Data Visualizer for small screen sizes #247615.

fixFixes an issue with queries getting malformed in anomaly charts, which was preventing the charts from rendering #246841.

fixUnifies the flow for clients partially and fully authorized to saved objects, and applies the intersection of allowed and authorized lists #244967.

fixFixes an issue where users running Elasticsearch with basic licenses would encounter errors when updating index mappings. Now, the Machine Learning saved object check will only run if saving semantic text mapping #248462.

9.2.3 Dec 19, 2025 Release notes ↗

securityFixes CVE-2025-68385: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers…

securityFixes CVE-2025-68389: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial…

securityFixes CVE-2025-68387: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse…

featureAdds the background task FleetPolicyRevisionsCleanupTask which removes excess policy revisions from the .fleet-policies index #242612.

featureThe API keys management page now defaults to showing personal API keys only #245261.

featureAdds a warning when deleting API keys currently used by alerting rules #243353.

fixFixes an issue that caused the Security alerts table to not update columns correctly when switching view modes #245253.

fixAdds consecutiveMatches to action context #244997.

fixFixes an issue with Discover tabs that occurs when navigating to a different tab while the previous tab is still initializing #245752.

fixFixes Discover's trace waterfall behavior with duplicate spans #244984.

fixFixes "now" and mixed-format date handling in the Share menu #245539.

fixFixes an issue with authentication when multiple OIDC providers are configured #243869.

fixFixes an ECS incompatibility with the kibana_started.elasticsearch.waitTime value in logs #245706.

fixFixes the serialization of meta.error in JSON layouts. If it is an Error instance, only message, name, and stack are included. Other fields are no longer returned in the logs #244364.

fixFixes JVM metric conflicts with explicit cast #244151.

9.2.2 Dec 2, 2025 Release notes ↗

securityFixes CVE-2025-37732: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up…

securityFixes CVE-2025-68386: Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha…

fixCaptures connector errors without interrupting the case creation flow. Issues with connectors can be resolved on the case details page #244188.

fixImproves error message for IBM Resilient connector failing to create an incident #244012.

fixFixes auto-extraction of observables when alerts are added to a case using the bulk actions menu #242325.

fixFixes pagination for the Alerts table, which was getting stuck on rule details pages #242275.

fixUses max_value instead of infinity for the default maximum height of a panel #243572.

fixFixes issue with saving dashboards after changing the dashboard link to an external link #243134.

fixFixes error that occurs when you deselect the (blank) option from the filter controls menu #242036.

fixUses long expiration for upgrading agents #243443.

fixFixes retrying agents stuck in auto-upgrade logic #243326.

fixAdds retry behavior for /api/fleet/agents when transient issues with Elasticsearch are encountered #243105.

fixFixes Docker image in the Add agent Kubernetes manifest #242691.

fixFixes truncation for longer text in the Discover table #241440.

fixFixes the production build favicon's CSS specificity #243351.

fixFixes an issue on the Index management page where screen reader text was different from visible text #243802.

fixFixes an issue with keyboard focus getting trapped on pages using document preview #243791.

fixEnsures deleted text in AI connector or Inference endpoint forms is not sent as empty strings #244059.

fixFixes data views showing runtime fields twice #242557.

fixFixes import and improves validation for Anomaly Detection and Data Frame Analytics jobs #242263.

fixTurns off custom suggestions on embedded console #241516.

9.2.1 Nov 11, 2025 Release notes ↗

featureThe defaultRoute advanced setting now controls the target of the Elastic logo link for spaces using a solution view #241571.

featureEnforces the object_src 'none' directive in Kibana's Content Security Policy and introduces a new csp.object_src configuration option to control its behavior #241029.

featureImproves layout wrapping in the Overview and Notifications tabs on the Machine Learning Overview page #239113.

fixFixes missing accessibility announcements in Cases #240132.

fixFixes an issue where references were being lost in Links, Maps, and legacy Visualize panels when updating a dashboard #241893.

fixFixes layout issues for markdown content in small panels #240806.

fixShows warnings in the integrations synchronization UI when referencing other entities #241623.

fixAdds proxy SSL options to download sources #241115.

fixOmits system properties when syncing ingest pipelines #241096.

fixFixes Fleet policy name uniqueness not being consistently enforced across spaces when name or space changes occur #239631.

fixFixes the autocomplete suggestion of time series sources in TS commands after a comma #241402.

fixEnsures all authentication fields show up correctly when setting up an AI connector #240913.

fixFixes an issue with Agents and Playground icons not rendering correctly in the Elasticsearch solution side navigation when using dark mode #240475.