Kibana 9.2.8 → 9.4.6

16 releases · 0 breaking changes · 108 security fixes · 59 advisories fixed

108security0breaking0deprecated94feature289fix

Is 9.2.8 affected? · What changed up to 9.5.5

Vulnerabilities fixed by this upgrade

4.3 CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…
8.1 CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…
6.5 CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…
6.5 CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…
7.3 CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…
6.3 CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…
5.4 CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…
6.5 CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…
7.3 CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…
4.3 CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica…
4.3 CVE-2026-78603 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal…
6.5 CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…
6.5 CVE-2026-72628 Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…
4.3 CVE-2026-72633 Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
6.5 CVE-2026-72644 Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use…
6.5 CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…
6.5 CVE-2026-33465 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could…
7.1 CVE-2026-72675 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its…
6.5 CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i…
7.3 CVE-2026-72677 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…
6.5 CVE-2026-72680 Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a…
8.1 CVE-2026-72665 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by…
6.8 CVE-2026-72666 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a…
6.5 CVE-2026-72667 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica…
7.6 CVE-2026-72669 The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic…
7.7 CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…
4.3 CVE-2026-72671 A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…
7.7 CVE-2026-72672 The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins…
5.4 CVE-2026-72673 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv…
7.3 CVE-2026-72658 Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf…
6.5 CVE-2026-72659 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki…
6.5 CVE-2026-72660 Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…
6.5 CVE-2026-72661 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…
6.5 CVE-2026-72663 Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV…
6.5 CVE-2026-72664 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…
4.3 CVE-2026-72650 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
6.5 CVE-2026-72651 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a…
6.5 CVE-2026-72653 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…
4.3 CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of…
7.1 CVE-2026-72632 Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r…
7.1 CVE-2026-72629 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i…
7.1 CVE-2026-72630 Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in…
6.5 CVE-2026-72631 Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t…
6.5 CVE-2026-49089 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope…
4.3 CVE-2026-49096 Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…
5.0 CVE-2026-63142 Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…
4.3 CVE-2026-63143 Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…
4.3 CVE-2026-63145 Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…
6.5 CVE-2026-63260 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…
6.5 CVE-2026-63261 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…
6.5 CVE-2026-56151 Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…
6.5 CVE-2026-49087 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…
6.5 CVE-2026-49095 Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…
6.5 CVE-2026-42399 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…
6.5 CVE-2026-42400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…
6.5 CVE-2026-33464 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…
4.1 CVE-2026-42401 Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…
4.6 CVE-2026-33462 A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…
5.3 CVE-2026-33463 Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.4.6
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.4.6
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.4.6
security Fixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age… in 9.4.6
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.4.6
security Fixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only… in 9.4.6
security Fixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… in 9.4.6
security Fixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal… in 9.4.6
security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.6
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.4.6
security Fixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by… in 9.4.5
security Fixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… in 9.4.5
security Fixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins… in 9.4.5
security Fixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic… in 9.4.5
security Fixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… in 9.4.5
security Fixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… in 9.4.5
security Fixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r… in 9.4.5
security Fixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A… in 9.4.5
security Fixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i… in 9.4.5
security Fixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in… in 9.4.5
security Fixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a… in 9.4.5
security Fixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use… in 9.4.5
security Fixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe… in 9.4.5
security Fixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i… in 9.4.5
security Fixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a… in 9.4.5
security Fixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… in 9.4.5
security Fixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… in 9.4.5
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.4.5
security Fixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… in 9.4.5
security Fixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… in 9.4.5
security Fixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… in 9.4.5
security Fixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t… in 9.4.5
security Fixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… in 9.4.5
security Fixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati… in 9.4.5
security Fixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… in 9.4.5
security Fixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.5
security Fixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… in 9.4.5
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.4.4
security Fixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func… in 9.4.4
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.4.4
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.4.4
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.4.4
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.4.4
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.4.4
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.4.4
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.4.4
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.4.4
security Fixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… in 9.4.4
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.4.4
security Fixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu… in 9.4.4
security Fixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. in 9.4.4
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.4.4
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.4.4
security Fixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t… in 9.4.4
security Fixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio… in 9.4.3
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.4.3
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.4.3
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.4.3
security Fixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… in 9.4.3
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.4.3
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.4.3
security Fixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us… in 9.4.3
security Fixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under… in 9.4.3
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.4.2
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.4.2
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.4.2
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.4.2
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.4.2
security Fixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper… in 9.4.0
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.3.8
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.3.8
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.3.8
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.3.8
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.3.8
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.3.8
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.3.8
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.3.8
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.3.8
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.3.8
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.3.8
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.3.8
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.3.7
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.7
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.3.6
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.3.6
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.3.6
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.3.6
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.3.5
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.3.5
security Fixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.5
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.3.5
security Fixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… in 9.3.5
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.3.5
security Fixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… in 9.3.5
security Fixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… in 9.3.5
security Fixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… in 9.3.5
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.3.5
security Fixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… in 9.3.5
security Fixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… in 9.3.4
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.3.3
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.3.3
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.3.3
security Fixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server… in 9.3.3
security Fixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest… in 9.3.3
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.3.3
security Fixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn… in 9.3.2
security Fixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… in 9.3.2
security Fixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could… in 9.3.0

Every release in between

9.4.6 Sep 1, 2026 Release notes ↗

securityFixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…

securityFixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…

securityFixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…

securityFixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age…

securityFixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…

securityFixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only…

securityFixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica…

securityFixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal…

securityFixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two…

featureAdd [Elastic Cloud Trial] prefix to email subjects sent through the built-in Elastic Cloud email service on trial deployments #276705.

featureAdd step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.

fixFix Agent Builder entering an infinite retry loop and hitting a recursion error when the plain-text answering path receives an empty model response #285823.

fixFix Anthropic inference endpoint stream parsing and Agent Builder silent retry loops on empty model responses #281616.

fixFix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when cross-cluster search index patterns are configured without the remote cluster client role #281609.

fixFix Anthropic inference endpoint requests sending temperature: 0 when no temperature was configured, causing unexpected model behavior in Agent Builder #281179.

fixFix alert suppression creating duplicate alerts when stored alerts use nested _source fields instead of flat dot-notation keys #282192.

fixFix by-reference Lens panels being removed from dashboards when their saved object references are missing #285476.

fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.

fixRemove the proxy configuration option from Kafka outputs, which don't support it #282313.

fixFix duplicate Cut, Copy, and Paste entries appearing in the Console context menu #286704.

fixFix Console autocomplete inserting boolean and numeric values as quoted strings instead of JSON primitives #286699.

fixFix Console body autocomplete failing after closed triple-quoted string values #286695.

fixFix Console autocomplete not triggering at request body positions, and correct template expansion and text corruption bugs when accepting suggestions #284530.

fixFix Console incorrectly showing autocomplete suggestions inside non-query triple-quoted strings #282424.

fixFix numeric field formats adding a sign prefix to values that round to zero #282919.

fixFix the percent field format displaying NaN when fractional is set to false #282915.

fixFix server-side date field formatting not reflecting timezone or pattern changes until Kibana is restarted #282501.

fixFix the Base64 Decode field format transform on the server side and for UTF-8 encoded data #281366.

fixFix PKI authentication sessions being unexpectedly invalidated when in-flight HTTP/2 requests are canceled, logging users out on TLS-enabled deployments #285153.

fixFix the Roles management page allowing navigation without warning when there are unsaved changes #283525.

fixFix Kibana failing to start when the audit log file location is misconfigured, and instead report a degraded state #282347.

fixFix the Data Frame Analytics results explorer not updating when switching to a different job of the same type #284964.

fixRestrict the trained model pipeline test endpoint to admin-level capabilities to prevent unauthorized data access #282002.

fixFix CSV exports generated by internal users (such as Fleet agent exports) failing with a parsing_exception error when xpack.reporting.csv.scroll.strategy: scroll is configured #286119.

fixFix the workflow editor blocking the Enabled toggle with an error when a foreach loop collection type cannot be statically proved #283360.

9.4.5 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by…

securityFixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…

securityFixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins…

securityFixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic…

securityFixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf…

securityFixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its…

securityFixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r…

securityFixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A…

securityFixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i…

securityFixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in…

securityFixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a…

securityFixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use…

securityFixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe…

securityFixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i…

securityFixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a…

securityFixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica…

securityFixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki…

securityFixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…

securityFixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV…

securityFixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…

securityFixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a…

securityFixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t…

securityFixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope…

securityFixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati…

securityFixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…

securityFixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of…

fixFix auto-created conversations overwriting an existing conversation that shares the same ID #280189.

fixFix attaching AIOps charts (change point, pattern analysis, log rate analysis) to a case failing with an "Attachment type is not registered" error #281157.

fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, the corrected behavior applies only to reports created or re-saved after upgrading; existing schedules keep their previous time-window behavior until they are recreated…

fixFix the alerts-as-data setup overriding an index's total fields limit that was already set to a higher value #277402.

fixFix duplicated Lens panels backed by a form-based ad hoc data view failing to load after you rename the data view or add a runtime field, caused by colliding ad hoc data view IDs #281786.

fixFix ad hoc data view resolution for Lens XY annotation layers created through the Visualizations API #281079.

fixFix the Visualizations API dropping the custom display name of inline (ad hoc) data views on round trip #280546.

fixFix dashboard PDF exports using a stale time range after you change the time picker when the dashboard does not save the time range #278262.

fixFix Fleet output edits failing with a validation error when more than 10 hosts were configured, by raising the host limit from 10 to 100 for Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs #282397.

fixFix the expiration parameter on POST /enrollment_api_keys being silently dropped, and add an Expiration field to the Create enrollment token form in Fleet #281324.

fixFix OpenTelemetry integration metrics not defaulting to the time_series index mode #281295.

fixFix the agent policy filter on the Agents list returning no agents for version-specific policies #281195.

fixFix the Add Fleet Server onboarding continuing to show after the Fleet Server agent moves to a version-specific policy #281092.

+13 more items in the release notes

9.4.4 Jul 21, 2026 Release notes ↗

securityFixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th…

securityFixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func…

securityFixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…

securityFixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…

securityFixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…

securityFixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…

securityFixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c…

securityFixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ…

securityFixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…

securityFixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv…

securityFixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…

securityFixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu…

securityFixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

securityFixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…

securityFixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…

securityFixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t…

featureAdds a cases.pushCases workflow step that pushes the given cases to their external connectors #267539.

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

featureSupports overriding data_stream.type in the simplified package policy API for input-only packages, so collected data can be routed to a different index prefix with matching agent index permissions #269895.

featureAdds a MongoDB connector datetime_conversion setting so syncs can clamp, convert, or error on dates outside the supported range instead of always aborting #277685.

fixImproves the Cases file upload modal with human-readable size limits, clearer unsupported-type messaging, per-file size checks, and error state that clears when a new file is selected #277567.

fixFixes OAuth client credentials token parsing so any 2xx response is treated as success #276321.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes ES|QL query rules dropping parentheses when appending a limit, which could change calculated results #275231.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixExtracts observables automatically when alerts are attached to a case through the comments API #274969.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixFixes the Google Drive connector so it can find and read files owned by a shared drive #274303.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes startup crashes from occurring when upgrading Kibana if a previous version's node.options file was preserved, caused by server-side imports of the browser-only @elastic/charts library #276284.

fixFixes horizontal padding in the Lens dimension editor #275993.

fixFixes the filter popover so that closing the context menu when saving a dashboard doesn't discard changes #275987.

fixFixes invisible field names in the Lens field picker when in dark mode #275785.

fixFixes incorrect color rendering for non-custom palettes in Lens metric charts #275203.

fixFixes color rendering in Lens gauge charts so a color band no longer extends past the configured range, and palette continuity is preserved on save #272123.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixFixes integration policy updates always bumping associated agent policy revisions, even when bumpRevision is false #275626.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes adding content connectors from Integrations so the enrollment flyout links to connector setup instead of waiting for incoming data #274832.

+24 more items in the release notes

9.4.3 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio…

securityFixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…

securityFixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…

securityFixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc…

securityFixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…

securityFixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…

securityFixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…

securityFixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us…

securityFixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under…

featureAdds xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control the Elasticsearch index.mapping.total_fields.limit on .alerts-* indices, index templates, and component templates. Raise this above the current alert mapping field count to prevent mapping-update failures…

fixFixes ES|QL query escaping in the Dashboard skill's visualization config generation, ensuring patterns such as GROK retain the correct escape levels when queries are embedded as JSON #272493.

fixFixes the Stack Alerts page triggering two search cycles on initial load when filter controls are present, which could cause a brief flash of unfiltered results #271441.

fixFixes dashboard filters not being applied after collapsing a section that was expanded on initial load #272751.

fixFixes dashboards with panel or filter arrays that exceed schema size limits failing to load, by removing the array-size ceiling from internal read requests #271326.

fixImproves dashboard load resilience by validating each state key independently, dropping invalid panels, filters, or queries with warnings rather than failing the entire load #270300.

fixIncreases the maximum number of combined panels, sections, and controls on a dashboard from 100 to 1,000 #272931.

fixFixes Save and return not working for Maps visualizations opened from the Visualize library #274002.

fixFixes a stale closure in the Canvas autoplay timer that could skip pages after slides are added or removed #268398.

fixDisables the experimental Defer loading panels below "the fold" dashboard setting (labs:dashboard:deferBelowFold) because enabling it can cause some dashboards to fail to load. The option remains in Advanced Settings but has no effect from this version. It might be enabled again in a future…

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixImproves POST /api/fleet/setup performance for deployments with many configured outputs by fetching only the required outputs instead of decrypting all saved outputs on each call #273848.

fixOptimizes the agent policies list endpoint (withAgentCount=true) to compute agent counts using a single aggregation instead of multiple queries per policy, greatly improving response time for large deployments #272429.

fixPrevents the agent version check from hanging indefinitely in air-gapped or firewall-restricted environments, and adds xpack.fleet.productVersionsApiTimeoutMs (default: 60 s) to control the request timeout #272715.

fixFixes variable leakage and duplication across policy templates in input packages that define multiple policy templates #273364.

fixIncludes input packages in the Integrations Signal type filter #272585.

fixFixes security rule names not displaying in the integration Assets accordion #272089.

fixFixes the agent logging level dropdown not updating after clicking Reset to policy on the agent Settings tab #271964.

fixFixes broken asset references in the integration Assets tab when an integration is reinstalled or upgraded from a different Kibana space #271800.

fixFixes per-integration output overrides for OpenTelemetry (OTel) integrations, and now raises a validation error when an unsupported output type is assigned instead of failing silently #270487.

fixFixes null and undefined field values in the ES|QL document summary column incorrectly counting toward the discover:maxDocFieldsDisplayed limit, which caused fields with real values to be hidden #273610.

fixFixes the Extend action icon in the Background searches panel being invisible in dark mode #272754.

fixFixes Discover session panels in dashboards failing to load after Copy to Spaces or import when the target space already contains remapped sessions #272610.

fixFixes a regression where KQL autocomplete suggestions stopped working in the ES|QL editor #273931.

fixFixes editing of object fields in the ES|QL lookup index editor when using dot-notation column names #273303.

fixAdds notifications.connectors.default.email as a Docker environment variable #272761.

fixFixes user profile retrieval in reverse proxy run_as configurations, ensuring the nav bar displays the effective user's avatar and name rather than the proxy user's #271314.

fixFixes product documentation installation timing out when the ML inference endpoint scales up from zero replicas (cold-start), and improves error messages when installation fails #270005.

fixLogs Dev Tools Console requests through the elasticsearch.query debug logger (method, path, and response status; request bodies are not included since Console streams them), and adds support for URL path prefixes in elasticsearch.hosts for Console proxy requests #271562.

fixFixes workflow executions that become orphaned from Task Manager now being cancelled immediately rather than waiting indefinitely for an asynchronous cancel #272672.

9.4.2 May 28, 2026 Release notes ↗

securityFixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…

securityFixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…

securityFixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…

securityFixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…

securityFixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…

featureImproves the Add inference endpoint and Edit inference endpoint flyouts with clearer titles, a footer Save button, task type descriptions in the selector, always-visible endpoint ID and API reference fields, and inline validation for required fields #262143.

fixFixes an issue that caused rules with large action parameter payloads to fail when saving or executing #269467.

fixFixes case workflow templates resolving from the wrong owner #268719.

fixFixes phrase search in the All Cases view #266827.

fixFixes the email connector to reject malformed email addresses (for example, local parts or domain labels with leading or trailing hyphens) that mail servers would reject, preventing unnecessary SMTP connection attempts #268496.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and space URL prefixes, preventing 404s on connector detail tabs and after creation #269571.

fixFixes the links panel transform to remove an unsupported enhancements property #270230.

fixFixes the Lens API so XY charts with legends at the top or bottom return the correct configuration #268729.

fixFixes the Lens Visualization API rejecting rank_by with operation: "count" on terms buckets when no field is specified, so Count can rank by all documents without a field #268620.

fixFixes the Visualization API to correctly show default datatable colored badges #268425.

fixFixes gauge chart min, max, and goal configuration to reject unsupported reference-based metric operations (moving_average, differences, cumulative_sum, counter_rate) that require a date histogram #268168.

fixParses top-level elasticsearch fields in integration packages on upgrade or reinstall #269080.

fixFixes the agent enrollment Confirm incoming data step timing out for integrations that ingest backdated data by checking event.ingested instead of @timestamp #268224.

fixPreserves the expanded document selection after refresh when comparing documents in Discover #268328.

fixAllows null in CASE() expressions combined with other types #269051.

fixFixes missing modal and popover labels for screen readers across Stack Management UIs #269652.

fixFixes File upload not disabling data view creation when the user lacks data view creation capabilities #268167.

fixMakes the with block optional in workflow YAML for connector steps that have no required parameters #269047.

9.4.1 May 12, 2026 Release notes ↗

fixFixes empty rule type fields, such as kibana.alert.reason, on active alert documents when a delayed alert graduates to active during a flapping hold without an executor report. #266012

fixFixes a critical validation failure that occurred when dashboard controls had null titles. Control titles are now converted to undefined during transforms, allowing validation to pass #268220.

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the ES|QL control edit flyout when editing an existing query-based control #267605.

9.4.0 May 5, 2026 Release notes ↗

securityFixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…

featureMakes maximumCasesToOpen a runtime property #259255.

featureAdds an auto-push case option to the case connector #249251.

featureExposes the maximumCasesToOpen parameter in the case action connection #247990.

featureAdds additional workflow steps #256922.

featureAlert deletion is now generally available #247465.

featureUpdates Test tool flyout to support datetime picker #249549.

featureSimplifies the ES|QL test tool parameter types #249855.

featureExposes configuration_overrides in agent_builder/converse API #249256.

featureAdds support for array parameter types in ES|QL tools #250386.

featureMigrates the flyout to a sidebar #252918.

featureAdds server-side support for user-created skills in Agent Builder #252493.

featureAdds agent and tools RBAC sub features #254464.

featureAgent Builder's default agent is no longer read-only and can now be customized per Kibana space #256333.

featureAdds user-created skills to Agent Builder #252221.

featureAllows Agent Builder to detect outdated attachments and lets users refresh them into the next message #257658.

featureAllows ES|QL generation to search index patterns #253492.

featureAllows agents to run one or more workflows before each execution, enabling prompt modifications or conditional abort #252452.

featureAdds audit logging for agent and tool create, update, and delete actions #252143.

featureAdds support for the region parameter to the Bedrock Connector #252956.

featureAdds a Jina Reader data source connector #247527.

featureAdds a Jira Cloud data source connector #251345.

featureAdds a SharePoint Online data source connector #251544.

featureAdds a ServiceNow data source connector #252430.

featureAdds a Microsoft Teams data source connector #252465.

featureAdds a Tavily data source connector #252717.

featureAdds a Google Calendar data source connector #252740.

featureAdds a Slack data source connector #252972.

featureAdds an Amazon S3 data source connector #253753.

featureAdds a Salesforce data source connector #254303.

featureAdds a Zendesk data source connector #254739.

featureAdds a Firecrawl data source connector #255004.

featureAdds a 1Password data source connector #255076.

featureAdds a PagerDuty data source connector #255154.

featureAdds a Zoom data source connector #255174.

featureAdds a Figma data source connector #255322.

featureAdds a Gmail data source connector #255565.

featureAdds an AWS Lambda data source connector #256150.

featureAdds a Confluence Cloud data source connector #256508.

featureAdds a Google Cloud Storage data source connector #257374.

+397 more items in the release notes

9.3.8 Jul 21, 2026 Release notes ↗

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

fixPrevents the Task Manager invalidate task from invalidating an API key that is still shared by other live tasks, which caused those tasks to fail with a security exception #275157.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes escape_string values that contain double quotes from corrupting surrounding agent policy YAML #279391.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes Console autocomplete so nested object fields and multi-fields in index mapping bodies suggest mapping options again #278508.

fixFixes Console requests that combine comments with triple-quote strings failing with x_content_e_o_f_exception #277259.

fixFixes a Windows-specific code editor issue that could corrupt multi-line edited text after refresh #277007.

fixFixes the Console Copy button silently failing to copy response output #276365.

fixFixes Console autocomplete matching an incorrect API endpoint when a URL matches both a literal path and a parameterized path #276239.

fixImproves Console ES|QL source autocomplete by reusing a fresh source list instead of refetching it on every keystroke #275535.

fixPrevents removing all spaces from a machine learning job or trained model through the spaces update APIs #276490.

fixRestricts the clear audit messages API so users can only clear messages for jobs they can access, and only against valid notification indices #276419.

fixFixes a crash in ES|QL query correction when an LLM generates a multi-line WHERE clause #277153.

9.3.7 Jun 30, 2026 Release notes ↗

fixFixes case pushes only stamping a subset of attachments, which caused the alert count comment to be duplicated in the external system on every push #274451.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes Canvas autoplay not advancing past the first page #272619.

fixFixes the agentless enrollment flyout for content connector integrations to show a connector configuration link instead of waiting for incoming data that cannot arrive until the connector is set up #274832.

fixImproves POST /api/fleet/setup performance for deployments with a large number of configured outputs by no longer decrypting every output on each call #273848.

fixFixes integration category filters sticking in place when scrolling the Integrations page on mobile #273499.

fixFixes a crash in the Integrations view when a package has no icon #273191.

fixFixes the ES|QL document summary column counting null values against the displayed field limit, which could hide fields with real values behind an "and X more fields" label #273610.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixFixes the Files plugin blob download to return the requested file type #274783.

fixFixes Dev Tools Console autocomplete in query filter context to suggest query DSL instead of the obsolete Elasticsearch 1.x filter DSL #272907.

9.3.6 Jun 23, 2026 Release notes ↗

fixFixes the Stack Alerts page fetching alerts twice on initial load by deferring table rendering until filter controls have finished initializing #271441.

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixFixes a stale closure in the Canvas autoplay timer that could advance to the wrong slide when slides were added or removed while autoplay was running #268398.

fixOptimizes GET /api/fleet/agent_policies (with withAgentCount=true) to compute agent counts in a single bucketed aggregation instead of multiple queries per policy, significantly reducing response time for deployments with many agent policies #272429.

fixFixes integration package reinstalls and upgrades performed from a space different from the original installation space incorrectly bucketing Kibana asset references, causing the Assets tab to display raw UUIDs instead of asset titles #271800.

fixFixes variable leakage and duplication between policy templates in input packages that define multiple policy templates #273364.

fixFixes security rule names not displaying in the integration Assets accordion when the rule object has no title field #272089.

fixFixes the agent logging level dropdown on the Settings tab not updating after Reset to policy is applied, so the displayed level now stays in sync with Fleet-polled agent metadata #271964.

fixFixes the Extend action icon in the Background searches row actions menu being invisible in dark mode by rendering it as an inline SVG that inherits the surrounding icon color #272754.

fixFixes slow KQL parsing caused by long runs of whitespace by improving keyword-adjacent whitespace handling in the KQL grammar #266512.

fixAdds notifications.connectors.default.email to the list of supported Docker environment variables #272761.

9.3.5 May 28, 2026 Release notes ↗

securityFixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…

securityFixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…

securityFixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…

securityFixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…

securityFixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…

fixFixes Elastic Stack rule upgrades failing when rule action params values exceed Elasticsearch field size limits by adding ignore_above: 4096 to the actions.params mapping #269467.

fixFixes alert index template updates failing when auto-increasing total_fields.limit because system-managed read-only fields were included in the update request #262534.

fixFixes phrase search in the All Cases view so quoted queries match exact phrases and unquoted queries match individual terms #266827.

fixFixes the email connector to reject malformed email addresses (for example, addresses with leading or trailing hyphens in the local part or domain labels) that mail servers would reject, preventing unnecessary SMTP connection attempts. Existing connectors saved with invalid addresses will fail…

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the control edit flyout when editing an existing query-based variable control #267605.

fixFixes agent policy background tasks failing with a parse_exception by sorting agent policies on updated_at instead of the non-existent created_at field #267285.

fixFixes a race condition during async integration knowledge base installation that could clear installed_es asset references for input packages and leave the Assets tab blank #266841.

fixUses password fields instead of cleartext inputs for multi-value secret variables in integration policy forms #266823.

fixFixes an issue in Discover's ES|QL mode so the expanded document flyout correctly stays on the same result after a refresh when METADATA _index, _id is available, and shows the original document without pagination when that result is no longer in the refreshed set #268328.

fixEnsures CSV exports from Discover use the absolute time range for the current session so exported data matches what you see on screen #255005.

fixFixes date conversion in the file sharing service #265131.

fixFixes Anomaly Detection chart markers in the Single Metric Viewer so sparse data points with a single value in the chart time range remain visible without hovering #263632.

fixFixes the IP Location processor in Ingest pipelines saving the wrong database_file and showing duplicate selections when a local database filename matches a managed database label #265740.

fixAdds accessible names to modals and popovers across Stack Management pages to improve screen reader support #269652.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and Kibana space prefixes, resolving 404 errors on connector detail tabs and the post-creation Manage connector action #269571.

fixPrevents each keystroke in the Advanced Settings search bar from adding a browser history entry, so the back button navigates away from the page in one step #266278.

fixFixes query rules API routes to limit the maximum size of arrays accepted in request data #265495.

fixFixes the Search Applications document explorer rendering HTML markup from field .snippet values #265319.

9.3.4 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…

featureRemembers the pagination state when navigating back from an edit on the Users page, instead of always returning to page 1 and resetting the search #261152.

fixFixes an issue where Stack alerts sent recovery notifications but remained active in Kibana instead of transitioning to recovered #261012.

fixAdds the application/x-zip-compressed MIME type as an accepted value for case file attachments #262414.

fixFixes the "Failed to check if maintenance windows are active" error #261048.

fixFixes YAML file downloads being truncated at the first # character by properly URL-encoding the content #264083.

fixFixes package policy count filters to correctly identify non-latest revisions #263717.

fixOnly auto-installs content packages that are newer than the installed version #262509.

fixFixes Fleet Server diagnostic bundles failing to download when elasticsearch.compression is enabled #262394.

fixFixes missing sort-state announcements for screen readers in the Ingest pipelines list #262226.

fixFixes focus management for the Learn more link #261902.

fixFixes screen reader announcements for the Define as JSON toggle #261896.

fixFixes screen readers announcing duplicate row indices in the Ingest pipelines list #261369.

fixFixes the inference processor form to accept the input_output configuration shape #260517.

fixFixes screen readers announcing icon labels twice in the Ingest pipelines list #259185.

fixFixes screen readers incorrectly combining button announcements on the Create Pipeline page #261603.

fixFixes stale screen reader announcements in code boxes #261921.

fixFixes the transforms detail summary to show all source_index entries when source_index is an array #261875.

fixFixes screen readers announcing search template options twice #261585.

fixFixes screen readers announcing duplicate row indices on the data streams table #261366.

fixFixes screen readers announcing icon labels twice in the Edit policy flyout #261324.

fixFixes screen readers announcing policy actions tooltip text twice in the index lifecycle policies list #261322.

fixFixes screen readers announcing copy button labels twice #261311.

fixFixes screen readers announcing grey color badge text twice in the transforms list #261307.

fixFixes screen readers not announcing invalid field validation errors #260673.

fixResets the time field when the updated index pattern does not include it #262001.

fixFixes ES|QL multi-value filtering with STATS #260998.

fixAdjusts the API Key flyout width #263858.

fixAllows space colors to be cleared, falling back to the default #261826.

fixFixes screen readers announcing data stream and index options twice in the Create policy and Restore snapshot selectable lists #261786.

fixFixes policy buttons to have distinguishable names for screen readers #261313.

fixFixes the single metric chart in Anomaly Explorer not showing anomaly actions correctly #263925.

fixUpdates the hono and @hono/node-server dependencies #263794.

fixFixes execution tree clipping when foreach has many iterations #253576.

9.3.3 Apr 8, 2026 Release notes ↗

securityFixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…

securityFixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…

securityFixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…

securityFixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server…

securityFixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest…

securityFixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…

fixFixes Webhook Connector accessTokenUrl validation #258290.

fixAdjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.

fixFixes Canvas library embeddables failing to load when savedObjectId is present without saved object references #257779.

fixFixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.

fixFixes Add from library in Canvas creating incorrect embeddable state #257261.

fixFixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes are saved #256984.

fixImproves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.

fixFixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.

fixFixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies are also counted #258387.

fixRestores keyboard focus to the Create a transform button on the Transforms page #258095.

fixEnhances screen reader notifications for bulk actions in Index Management tables, providing live announcements when the bulk actions menu becomes visible or hidden #257089.

fixFixes the query rules UI rejecting case variants as duplicate values #259506.

fixFixes only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.

fixPrevents creating incompatible inference endpoints when adding a semantic_text field in the Index Management mappings editor #256586.

fixFixes the anomaly swim lane dashboard panel not refreshing #259962.

fixFixes a console error when opening the data frame analytics jobs list #258591.

fixAdds aria labels to job wizard combo boxes #258509.

9.3.2 Mar 19, 2026 Release notes ↗

securityFixes CVE-2026-42398: Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook conn…

securityFixes CVE-2026-26940: Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow…

featureAdds Gemini 2.5 Flash Lite, Claude 4.5 Haiku, and Claude 4.6 Sonnet models to preconfigured connectors #253109.

fixFixes a bug in the platform.core.search tool and index_search tool type where nested fields were ignored when searching for matching documents #255914.

fixFixes MCP connectors ignoring the proxy and SSL configuration from the actions plugin (xpack.actions configuration property) #255813.

fixFixes a problem generating a report with multi-page Canvas workpads #255022.

fixFixes a blank page appearing at the end of PDF exports when using the Print format option with an even number of dashboard visualizations #254957.

fixImproves handling of 204 responses #251090.

fixFixes an issue where embedded panels in Canvas workpads could lose their saved object references, causing panels to fail to load #252191.

fixFixes the Add from library action adding incorrect embeddable state #257261.

fixFixes Lens transforms #257224.

fixFixes an issue where dashboard panels could get stuck in an infinite loading state after an error instead of showing error messages #257188.

fixFixes Maps failing to load when the stored time filter contained a quick mode value #255178.

fixFixes the unenroll task and adds an FTR test #255726.

fixFixes the incorrect installation of assets #254923.

fixFixes glitchy rendering in the Attributes tab #255173.

fixFixes the spaces list displaying No spaces match text on load #255654.

fixFixes the embeddable console auto-closing on chrome or overlay clicks #253382.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixAdds waitFor for the privilege button #255094.

fixFixes an issue where saving a dashboard included access control features when a user profile was not available #255065.

fixFixes screen reader announcements for flyouts #256409.

fixImproves name announcement in the index mode modal #256392.

fixFixes an issue in Dev Tools Console where syntax highlighting broke when queries contained accented or non-ASCII characters #255649.

fixFixes an issue in Dev Tools Console where closing nested braces broke syntax highlighting for subsequent elements #255426.

fixChanges the Run in Console button type #256455.

fixFixes Search Playground routes to limit the maximum size of arrays #255881.

fixFixes focus behavior when there are errors in the connector flyout form #255770.

fixAdds server-side API key generation #256083.

9.3.1 Feb 26, 2026 Release notes ↗

featureAllows integration rollback even if all package policies are not on an upgraded version #253646.

featureAdds a dynamic default connector to GenAI settings #252861.

featureAdds missing ES|QL commands and functions documentation for inference tasks #249089.

fixFixes a bug with PagerDuty where setting the Custom details field causes rules to fail #253683.

fixAdds external reference IDs to the attached documents check when a case is selected #253107.

fixFixes rule execution failing due to null execution UUIDs #252618.

fixImproves handling of 204 responses #251090.

fixFixes AI Connector form fields incorrectly resetting to default values when cleared with backspace #251095.

fixUpdates connector description terminology to reference "pre-configured AI connectors" #250649.

fixFixes layer editor scrolling in the full Lens editor #253247.

fixFixes runtime_mappings being ignored or overridden in Vega specs when defined in data[].url.body #253560.

fixFixes an issue where an agent rolled back after an upgrade could not be upgraded again in Fleet UI #253850.

fixFixes the handling of missing values #251892.

fixStrips system-managed date fields from ingest pipelines before PUT requests #252579.

fixFixes Stack Monitoring breadcrumb when in solution view #249751.

fixFixes "today" and "this week" filters for Log Rate and Pattern Analysis embeddables #252925.

fixFixes word break in Anomaly Detection page titles #250058.

fixFixes autocomplete not working in embedded console #253306.

fixFixes an issue loading the doc count in index management when viewing larger page sizes with long index names #252422.

fixFixes a validation error for AI pipeline suggestions with empty grok patterns #251113.

fixFixes the homepage throwing errors when the license level is below Enterprise #251484.

fixReduces background polling on the Index Details page to avoid unnecessary API requests #251446.

fixFixes links being visible on Search homepage when the user doesn't have access #251437.

fixAdds datemath support to the KQL evaluator #252840.

9.3.0 Feb 3, 2026 Release notes ↗

securityFixes CVE-2026-33465: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could…

featureElastic Agent Builder is now generally available. It is enabled by default in Elasticsearch solution environments, and you can opt in to Agent Builder and its AI Agent chat experience in Observability and Security solution environments. Learn how to get started.

featureSupports searching for report schedules by title and creator #243841.

featureProvides fields for specifying cc and bcc recipients, the subject line, and the message for scheduled report email notifications #242922.

featureEnables incremental human-readable case IDs #238555.

featureAdds option to delete report schedules #238197.

featureAlert cleanup is now generally available #247465.

featureAdds search to the new Attachments tab in cases #246265.

featureAdds support for searching rules by their actions' params using the API #246123.

featureScheduled reports are now generally available #245882.

featureThe Slack connector can now be configured to send messages to any channel using channel names #245423.

featureImproves search on the case management page #245321.

featureAdds option to enable disabled report schedules #244202.

featureDisable flapping per rule - schema only changes #243855.

featureCentralizes tabs for different attachement types under the new Attachments tab in cases #243708.

featureAdds a date time picker to the cases management page to help you find cases that were created during a specific time range #243409.

featureAdds option to edit report schedules #241928.

featureImproves UI for specifying additional fields for IBM Resilient action #238869.

featureMakes Agent ID the default observables type #238533.

featureAdds kibana.alert.index_pattern to all Stack alerts. This change doesn't affect detection alerts #239450.

featureElastic will regularly be adding new AI models from 9.3 onwards which will appear as pre-configured AI connectors in Kibana. Refer to the Elastic Inference Service page for more details.

featureAdds Groq to the list of available providers for the Inference/AI Connector and for Inference endpoint creation #244962.

featureIntroduces a Brave Search connector #245329.

featureThe webhook connector now supports the following HTTP request methods: POST(default), PUT, PATCH, GET, and DELETE #238072.

featureAdds new preconfigured connectors and updates existing ones #242791.

featureAdds a new temperature parameter to AI Connector and to OpenAI, Bedrock, and Gemini connectors #239806.

featureAdds support for headers in the OpenAI integration #238710.

featureDashboards now support ownership and "write_restricted" mode. You can now keep dashboards publicly editable or in a write-restricted state until they are ready to be published, giving you more control over who can edit your dashboards, regardless of broader space permissions #224552.

featureAdds support for chaining variable controls. You can now set up variable controls to depend on the values selected for another variable control #242909.

featureAdds basic filtering support for interactions with ES|QL charts #243439.

featureRemoves the Supporting visualization section heading from the Primary Metric editor. All configuration options remain fully accessible in the same location under Appearance #245979.

featureReorganizes and renames color settings in the Primary Metric dimension editor. For numeric metrics, the "Color by value" and "Color mapping"/"Color" settings are now located under the "Background chart" field. The settings have been renamed as follows: "Color by value" is now "Color mode", and…

featureIn dashboard visualization in-line editing and Lens workspace, the 'Appearance', 'Titles and text', 'Axis', and 'Legend' settings have been moved from a popover into a dedicated flyout panel #240804.

featureMoves the Lens visualization toolbar from the workspace section to the configuration panel #239879

featureMoves the Save as and Reset options under the top nav Save button when the dashboard is in edit mode #237211.

featureThe Lens configuration panel has been redesigned to display layers as tabs instead of vertically stacked panels. Layer actions (clone, remove, save) are now accessible through a menu in each tab, improving the editing experience when working with multiple data layers, annotations, and reference…

featureEnables integration knowledge generation by default and adds a UI setting that allows you to opt out of the integration knowledge indexing #245080.

featureEnables rolling back integrations to the previously installed version #240761.

featureAdds capability for rolling back a recent upgrade of a Fleet-managed Elastic Agent using Fleet UI or API #247398, #249416.

featureAdds functionality for removing root privilege from Fleet-managed agents if applicable #237790.

+197 more items in the release notes