Kibana 9.3.2 → 9.4.0

7 releases · 0 breaking changes · 37 security fixes · 13 advisories fixed

37security0breaking0deprecated42feature106fix

Is 9.3.2 affected? · What changed up to 9.5.5

Vulnerabilities fixed by this upgrade

4.3 CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…
6.5 CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…
6.5 CVE-2026-49087 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…
6.3 CVE-2026-49093 Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server…
6.5 CVE-2026-42399 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…
4.1 CVE-2026-42401 Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…
4.6 CVE-2026-33462 A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…
5.3 CVE-2026-33463 Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…
6.3 CVE-2026-33458 Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest…
6.5 CVE-2026-33459 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…
7.7 CVE-2026-4498 Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…
7.7 CVE-2026-33461 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…
4.3 CVE-2026-33460 Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper… in 9.4.0
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.3.8
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.3.8
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.3.8
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.3.8
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.3.8
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.3.8
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.3.8
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.3.8
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.3.8
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.3.8
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.3.8
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.3.8
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.3.7
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.7
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.3.6
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.3.6
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.3.6
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.3.6
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.3.5
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.3.5
security Fixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.3.5
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.3.5
security Fixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… in 9.3.5
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.3.5
security Fixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… in 9.3.5
security Fixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… in 9.3.5
security Fixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… in 9.3.5
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.3.5
security Fixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… in 9.3.5
security Fixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… in 9.3.4
security Fixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… in 9.3.3
security Fixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… in 9.3.3
security Fixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi… in 9.3.3
security Fixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server… in 9.3.3
security Fixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest… in 9.3.3
security Fixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… in 9.3.3

Every release in between

9.4.0 May 5, 2026 Release notes ↗

securityFixes CVE-2026-102410: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Exper…

featureMakes maximumCasesToOpen a runtime property #259255.

featureAdds an auto-push case option to the case connector #249251.

featureExposes the maximumCasesToOpen parameter in the case action connection #247990.

featureAdds additional workflow steps #256922.

featureAlert deletion is now generally available #247465.

featureUpdates Test tool flyout to support datetime picker #249549.

featureSimplifies the ES|QL test tool parameter types #249855.

featureExposes configuration_overrides in agent_builder/converse API #249256.

featureAdds support for array parameter types in ES|QL tools #250386.

featureMigrates the flyout to a sidebar #252918.

featureAdds server-side support for user-created skills in Agent Builder #252493.

featureAdds agent and tools RBAC sub features #254464.

featureAgent Builder's default agent is no longer read-only and can now be customized per Kibana space #256333.

featureAdds user-created skills to Agent Builder #252221.

featureAllows Agent Builder to detect outdated attachments and lets users refresh them into the next message #257658.

featureAllows ES|QL generation to search index patterns #253492.

featureAllows agents to run one or more workflows before each execution, enabling prompt modifications or conditional abort #252452.

featureAdds audit logging for agent and tool create, update, and delete actions #252143.

featureAdds support for the region parameter to the Bedrock Connector #252956.

featureAdds a Jina Reader data source connector #247527.

featureAdds a Jira Cloud data source connector #251345.

featureAdds a SharePoint Online data source connector #251544.

featureAdds a ServiceNow data source connector #252430.

featureAdds a Microsoft Teams data source connector #252465.

featureAdds a Tavily data source connector #252717.

featureAdds a Google Calendar data source connector #252740.

featureAdds a Slack data source connector #252972.

featureAdds an Amazon S3 data source connector #253753.

featureAdds a Salesforce data source connector #254303.

featureAdds a Zendesk data source connector #254739.

featureAdds a Firecrawl data source connector #255004.

featureAdds a 1Password data source connector #255076.

featureAdds a PagerDuty data source connector #255154.

featureAdds a Zoom data source connector #255174.

featureAdds a Figma data source connector #255322.

featureAdds a Gmail data source connector #255565.

featureAdds an AWS Lambda data source connector #256150.

featureAdds a Confluence Cloud data source connector #256508.

featureAdds a Google Cloud Storage data source connector #257374.

+397 more items in the release notes

9.3.8 Jul 21, 2026 Release notes ↗

securityFixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th…

securityFixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…

securityFixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…

securityFixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…

securityFixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…

securityFixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…

securityFixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c…

securityFixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ…

securityFixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…

securityFixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…

securityFixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…

securityFixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

fixPrevents the Task Manager invalidate task from invalidating an API key that is still shared by other live tasks, which caused those tasks to fail with a security exception #275157.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes escape_string values that contain double quotes from corrupting surrounding agent policy YAML #279391.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes Console autocomplete so nested object fields and multi-fields in index mapping bodies suggest mapping options again #278508.

fixFixes Console requests that combine comments with triple-quote strings failing with x_content_e_o_f_exception #277259.

fixFixes a Windows-specific code editor issue that could corrupt multi-line edited text after refresh #277007.

fixFixes the Console Copy button silently failing to copy response output #276365.

fixFixes Console autocomplete matching an incorrect API endpoint when a URL matches both a literal path and a parameterized path #276239.

fixImproves Console ES|QL source autocomplete by reusing a fresh source list instead of refetching it on every keystroke #275535.

fixPrevents removing all spaces from a machine learning job or trained model through the spaces update APIs #276490.

fixRestricts the clear audit messages API so users can only clear messages for jobs they can access, and only against valid notification indices #276419.

fixFixes a crash in ES|QL query correction when an LLM generates a multi-line WHERE clause #277153.

9.3.7 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc…

securityFixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

fixFixes case pushes only stamping a subset of attachments, which caused the alert count comment to be duplicated in the external system on every push #274451.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes Canvas autoplay not advancing past the first page #272619.

fixFixes the agentless enrollment flyout for content connector integrations to show a connector configuration link instead of waiting for incoming data that cannot arrive until the connector is set up #274832.

fixImproves POST /api/fleet/setup performance for deployments with a large number of configured outputs by no longer decrypting every output on each call #273848.

fixFixes integration category filters sticking in place when scrolling the Integrations page on mobile #273499.

fixFixes a crash in the Integrations view when a package has no icon #273191.

fixFixes the ES|QL document summary column counting null values against the displayed field limit, which could hide fields with real values behind an "and X more fields" label #273610.

fixFixes an issue where the Kibana JSON logger could produce JSON objects with a large number of numbered keys #256233.

fixFixes the Files plugin blob download to return the requested file type #274783.

fixFixes Dev Tools Console autocomplete in query filter context to suggest query DSL instead of the obsolete Elasticsearch 1.x filter DSL #272907.

9.3.6 Jun 23, 2026 Release notes ↗

securityFixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…

securityFixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…

securityFixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…

securityFixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…

fixFixes the Stack Alerts page fetching alerts twice on initial load by deferring table rendering until filter controls have finished initializing #271441.

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixFixes a stale closure in the Canvas autoplay timer that could advance to the wrong slide when slides were added or removed while autoplay was running #268398.

fixOptimizes GET /api/fleet/agent_policies (with withAgentCount=true) to compute agent counts in a single bucketed aggregation instead of multiple queries per policy, significantly reducing response time for deployments with many agent policies #272429.

fixFixes integration package reinstalls and upgrades performed from a space different from the original installation space incorrectly bucketing Kibana asset references, causing the Assets tab to display raw UUIDs instead of asset titles #271800.

fixFixes variable leakage and duplication between policy templates in input packages that define multiple policy templates #273364.

fixFixes security rule names not displaying in the integration Assets accordion when the rule object has no title field #272089.

fixFixes the agent logging level dropdown on the Settings tab not updating after Reset to policy is applied, so the displayed level now stays in sync with Fleet-polled agent metadata #271964.

fixFixes the Extend action icon in the Background searches row actions menu being invisible in dark mode by rendering it as an inline SVG that inherits the surrounding icon color #272754.

fixFixes slow KQL parsing caused by long runs of whitespace by improving keyword-adjacent whitespace handling in the KQL grammar #266512.

fixAdds notifications.connectors.default.email to the list of supported Docker environment variables #272761.

9.3.5 May 28, 2026 Release notes ↗

securityFixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…

securityFixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…

securityFixes CVE-2026-72652: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…

securityFixes CVE-2026-42399: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia…

securityFixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…

securityFixes CVE-2026-33464: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall…

securityFixes CVE-2026-33463: Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time…

securityFixes CVE-2026-33462: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi…

securityFixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…

securityFixes CVE-2026-42401: Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi…

fixFixes Elastic Stack rule upgrades failing when rule action params values exceed Elasticsearch field size limits by adding ignore_above: 4096 to the actions.params mapping #269467.

fixFixes alert index template updates failing when auto-increasing total_fields.limit because system-managed read-only fields were included in the update request #262534.

fixFixes phrase search in the All Cases view so quoted queries match exact phrases and unquoted queries match individual terms #266827.

fixFixes the email connector to reject malformed email addresses (for example, addresses with leading or trailing hyphens in the local part or domain labels) that mail servers would reject, preventing unnecessary SMTP connection attempts. Existing connectors saved with invalid addresses will fail…

fixFixes a regression where the dashboard remained locked in an open-flyout state after closing the control edit flyout when editing an existing query-based variable control #267605.

fixFixes agent policy background tasks failing with a parse_exception by sorting agent policies on updated_at instead of the non-existent created_at field #267285.

fixFixes a race condition during async integration knowledge base installation that could clear installed_es asset references for input packages and leave the Assets tab blank #266841.

fixUses password fields instead of cleartext inputs for multi-value secret variables in integration policy forms #266823.

fixFixes an issue in Discover's ES|QL mode so the expanded document flyout correctly stays on the same result after a refresh when METADATA _index, _id is available, and shows the original document without pagination when that result is no longer in the refreshed set #268328.

fixEnsures CSV exports from Discover use the absolute time range for the current session so exported data matches what you see on screen #255005.

fixFixes date conversion in the file sharing service #265131.

fixFixes Anomaly Detection chart markers in the Single Metric Viewer so sparse data points with a single value in the chart time range remain visible without hovering #263632.

fixFixes the IP Location processor in Ingest pipelines saving the wrong database_file and showing duplicate selections when a local database filename matches a managed database label #265740.

fixAdds accessible names to modals and popovers across Stack Management pages to improve screen reader support #269652.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and Kibana space prefixes, resolving 404 errors on connector detail tabs and the post-creation Manage connector action #269571.

fixPrevents each keystroke in the Advanced Settings search bar from adding a browser history entry, so the back button navigates away from the page in one step #266278.

fixFixes query rules API routes to limit the maximum size of arrays accepted in request data #265495.

fixFixes the Search Applications document explorer rendering HTML markup from field .snippet values #265319.

9.3.4 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-49087: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b…

featureRemembers the pagination state when navigating back from an edit on the Users page, instead of always returning to page 1 and resetting the search #261152.

fixFixes an issue where Stack alerts sent recovery notifications but remained active in Kibana instead of transitioning to recovered #261012.

fixAdds the application/x-zip-compressed MIME type as an accepted value for case file attachments #262414.

fixFixes the "Failed to check if maintenance windows are active" error #261048.

fixFixes YAML file downloads being truncated at the first # character by properly URL-encoding the content #264083.

fixFixes package policy count filters to correctly identify non-latest revisions #263717.

fixOnly auto-installs content packages that are newer than the installed version #262509.

fixFixes Fleet Server diagnostic bundles failing to download when elasticsearch.compression is enabled #262394.

fixFixes missing sort-state announcements for screen readers in the Ingest pipelines list #262226.

fixFixes focus management for the Learn more link #261902.

fixFixes screen reader announcements for the Define as JSON toggle #261896.

fixFixes screen readers announcing duplicate row indices in the Ingest pipelines list #261369.

fixFixes the inference processor form to accept the input_output configuration shape #260517.

fixFixes screen readers announcing icon labels twice in the Ingest pipelines list #259185.

fixFixes screen readers incorrectly combining button announcements on the Create Pipeline page #261603.

fixFixes stale screen reader announcements in code boxes #261921.

fixFixes the transforms detail summary to show all source_index entries when source_index is an array #261875.

fixFixes screen readers announcing search template options twice #261585.

fixFixes screen readers announcing duplicate row indices on the data streams table #261366.

fixFixes screen readers announcing icon labels twice in the Edit policy flyout #261324.

fixFixes screen readers announcing policy actions tooltip text twice in the index lifecycle policies list #261322.

fixFixes screen readers announcing copy button labels twice #261311.

fixFixes screen readers announcing grey color badge text twice in the transforms list #261307.

fixFixes screen readers not announcing invalid field validation errors #260673.

fixResets the time field when the updated index pattern does not include it #262001.

fixFixes ES|QL multi-value filtering with STATS #260998.

fixAdjusts the API Key flyout width #263858.

fixAllows space colors to be cleared, falling back to the default #261826.

fixFixes screen readers announcing data stream and index options twice in the Create policy and Restore snapshot selectable lists #261786.

fixFixes policy buttons to have distinguishable names for screen readers #261313.

fixFixes the single metric chart in Anomaly Explorer not showing anomaly actions correctly #263925.

fixUpdates the hono and @hono/node-server dependencies #263794.

fixFixes execution tree clipping when foreach has many iterations #253576.

9.3.3 Apr 8, 2026 Release notes ↗

securityFixes CVE-2026-4498: Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122…

securityFixes CVE-2026-33461: Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve…

securityFixes CVE-2026-33459: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submi…

securityFixes CVE-2026-49093: Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server…

securityFixes CVE-2026-33458: Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist rest…

securityFixes CVE-2026-33460: Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret…

fixFixes Webhook Connector accessTokenUrl validation #258290.

fixAdjusts scrolling when you drag and drop a dashboard panel to avoid jumping #258445.

fixFixes Canvas library embeddables failing to load when savedObjectId is present without saved object references #257779.

fixFixes a race condition in the dashboard backup service and removes unnecessary error toasts #257762.

fixFixes Add from library in Canvas creating incorrect embeddable state #257261.

fixFixes Lens panels appearing to revert after inline edits until you refresh the page, even though changes are saved #256984.

fixImproves screen reader announcements and focus when moving processors in the ingest pipeline editor #259096.

fixFixes Fleet bulk agent actions (unenroll, upgrade, reassign to policy) not respecting the current space when selection uses a kuery filter #258582.

fixFixes automatic agent upgrades stopping early with “target percentage already reached” because agents upgrading in other policies are also counted #258387.

fixRestores keyboard focus to the Create a transform button on the Transforms page #258095.

fixEnhances screen reader notifications for bulk actions in Index Management tables, providing live announcements when the bulk actions menu becomes visible or hidden #257089.

fixFixes the query rules UI rejecting case variants as duplicate values #259506.

fixFixes only passing filtered rules to the API and deleting rules not matching the filter in the Query Rule Set editor #259503.

fixPrevents creating incompatible inference endpoints when adding a semantic_text field in the Index Management mappings editor #256586.

fixFixes the anomaly swim lane dashboard panel not refreshing #259962.

fixFixes a console error when opening the data frame analytics jobs list #258591.

fixAdds aria labels to job wizard combo boxes #258509.