Kibana 9.4.1 → 9.4.8

7 releases · 0 breaking changes · 71 security fixes · 71 advisories fixed

71security0breaking0deprecated8feature186fix

Is 9.4.1 affected? · What changed up to 9.5.5

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…
8.8 CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym…
6.5 CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
8.1 CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…
6.5 CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…
5.5 CVE-2026-78601 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati…
6.5 CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…
7.3 CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…
6.3 CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…
5.4 CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…
4.3 CVE-2026-78584 Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu…
6.5 CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…
7.3 CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…
4.3 CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica…
4.3 CVE-2026-78603 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal…
4.2 CVE-2026-78606 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two…
6.5 CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…
6.5 CVE-2026-72682 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age…
6.5 CVE-2026-72628 Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…
4.3 CVE-2026-72633 Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
5.4 CVE-2026-72641 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only…
6.5 CVE-2026-72644 Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use…
8.3 CVE-2026-63137 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio…
6.5 CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe…
6.5 CVE-2026-72674 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th…
7.1 CVE-2026-72675 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its…
6.5 CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i…
7.3 CVE-2026-72677 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…
6.5 CVE-2026-72680 Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a…
6.5 CVE-2026-72681 Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func…
8.1 CVE-2026-72665 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by…
6.8 CVE-2026-72666 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a…
6.5 CVE-2026-72667 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica…
7.6 CVE-2026-72669 The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic…
7.7 CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…
4.3 CVE-2026-72671 A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…
7.7 CVE-2026-72672 The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins…
5.4 CVE-2026-72673 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv…
7.3 CVE-2026-72658 Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf…
6.5 CVE-2026-72659 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki…
6.5 CVE-2026-72660 Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…
6.5 CVE-2026-72661 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…
6.5 CVE-2026-72663 Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV…
6.5 CVE-2026-72664 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…
4.3 CVE-2026-72650 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
6.5 CVE-2026-72651 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a…
6.5 CVE-2026-72653 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…
4.3 CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of…
7.1 CVE-2026-72632 Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r…
7.1 CVE-2026-72643 Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A…
7.1 CVE-2026-72629 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i…
7.1 CVE-2026-72630 Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in…
6.5 CVE-2026-72631 Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t…
6.5 CVE-2026-49089 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope…
4.3 CVE-2026-49096 Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…
4.3 CVE-2026-63262 Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.
5.0 CVE-2026-63142 Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…
4.3 CVE-2026-63143 Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…
4.3 CVE-2026-63145 Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…
4.3 CVE-2026-63259 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t…
6.5 CVE-2026-63260 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…
6.5 CVE-2026-63261 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…
6.3 CVE-2026-63141 Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ…
7.1 CVE-2026-56147 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc…
6.5 CVE-2026-63139 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c…
5.4 CVE-2026-56146 Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us…
4.3 CVE-2026-49092 Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under…
6.5 CVE-2026-42397 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…
6.5 CVE-2026-56151 Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…
6.5 CVE-2026-49095 Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…
6.5 CVE-2026-42400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li… in 9.4.8
security Fixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… in 9.4.7
security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 9.4.7
security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.4.6
security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.4.6
security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.4.6
security Fixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age… in 9.4.6
security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.4.6
security Fixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only… in 9.4.6
security Fixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… in 9.4.6
security Fixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal… in 9.4.6
security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.6
security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.4.6
security Fixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by… in 9.4.5
security Fixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… in 9.4.5
security Fixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins… in 9.4.5
security Fixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic… in 9.4.5
security Fixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… in 9.4.5
security Fixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… in 9.4.5
security Fixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r… in 9.4.5
security Fixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A… in 9.4.5
security Fixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i… in 9.4.5
security Fixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in… in 9.4.5
security Fixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a… in 9.4.5
security Fixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use… in 9.4.5
security Fixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe… in 9.4.5
security Fixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i… in 9.4.5
security Fixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a… in 9.4.5
security Fixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… in 9.4.5
security Fixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… in 9.4.5
security Fixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… in 9.4.5
security Fixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… in 9.4.5
security Fixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… in 9.4.5
security Fixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… in 9.4.5
security Fixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t… in 9.4.5
security Fixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… in 9.4.5
security Fixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati… in 9.4.5
security Fixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… in 9.4.5
security Fixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.4.5
security Fixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… in 9.4.5
security Fixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th… in 9.4.4
security Fixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func… in 9.4.4
security Fixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use… in 9.4.4
security Fixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte… in 9.4.4
security Fixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… in 9.4.4
security Fixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… in 9.4.4
security Fixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c… in 9.4.4
security Fixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… in 9.4.4
security Fixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ… in 9.4.4
security Fixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… in 9.4.4
security Fixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… in 9.4.4
security Fixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… in 9.4.4
security Fixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu… in 9.4.4
security Fixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. in 9.4.4
security Fixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu… in 9.4.4
security Fixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… in 9.4.4
security Fixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t… in 9.4.4
security Fixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio… in 9.4.3
security Fixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… in 9.4.3
security Fixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… in 9.4.3
security Fixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc… in 9.4.3
security Fixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… in 9.4.3
security Fixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… in 9.4.3
security Fixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… in 9.4.3
security Fixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us… in 9.4.3
security Fixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under… in 9.4.3
security Fixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… in 9.4.2
security Fixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… in 9.4.2
security Fixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… in 9.4.2
security Fixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… in 9.4.2
security Fixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… in 9.4.2

Every release in between

9.4.8 Oct 6, 2026 Release notes ↗

securityFixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…

fixFix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.

fixFix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.

fixFix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874.

fixFix Jira Service Management and Opsgenie connector actions failing when the rendered alert message exceeds 130 characters. The connectors now truncate the message instead #291698.

fixIncrease the TinyMath expression length limit so longer visualization formulas don't fail #290314.

fixFix Go to URL drilldowns leaving Mustache tokens such as event.values.[0] unreplaced in the drilldown name #290363.

fixFix deleting a managed integration policy leaving the agent listed as active #290181.

fixFix update and delete of legacy managed integration policies returning HTTP 404 or reporting success while the deployment kept running #287011.

fixFix agents for Elastic managed integrations enrolled in other Kibana spaces appearing in the Fleet Agents list #293142.

fixFix version-specific agent policy assignment failing repeatedly for agent policies in non-default Kibana spaces #293010.

fixFix the Fleet output edit flyout freezing or showing no counts when thousands of agent policies use the output #291972.

fixFix Elastic Agent upgrade and agent policy requests hanging for up to two minutes and failing with a reset connection when Kibana can't retrieve the list of available Elastic Agent versions #292788.

fixFix integration upgrades failing when you add a custom analyzer or normalizer to a @custom component template after the write index is created. Fleet now rolls over the data stream instead #291813.

fixFix Fleet installing only the first trained model when an integration package includes several #290145.

fixFix ambiguous_conflict errors on dashboard assets when you install an integration in multiple Kibana spaces #291648.

fixFix installed integration icons rendering as black shapes #293176.

fixFix the Edit pipeline button in the ingest pipeline details flyout moving off-screen when a processor contains a long value #291000.

fixFix Index Management moving component templates listed in ignore_missing_component_templates to the end of composed_of when you edit or clone an index template #290171.

fixFix Console reporting Elasticsearch request timeouts as connection failures. Console now explains that the request might still be running and suggests checking its status before you retry #289481.

fixAdd an Expand site group members toggle to SharePoint Online connectors for compact document-level security #288070.

fixAdd a Sync all mail folders option to the Outlook connector #291396.

fixFix deleted content connectors remaining in the connectors list #290859.

fixHide the Activate user action on deactivated users when you have read-only access #289801.

fixFix a failed audit log write after startup crashing Kibana. Kibana now reports a degraded state and turns the audit logger off instead #287360.

fixFix Kibana shutting down when the product documentation installer downloads a corrupt or incomplete artifact #291142.

fixFix PDF and PNG reports using too much memory and failing on memory-constrained instances when you generate them from a wide browser window #289062.

fixFix streaming inference requests returning no content when elasticsearch.compression is enabled, which made Agent Builder report an empty response #290381.

fixFix LLM feature settings listing every connector when you lack inference privileges, instead of only the allowed connectors #290457.

fixFix LLM resolution failing when you lack the Actions privilege and an inference endpoint is configured in model settings #290533.

fixFix the anomaly detection bucket span estimation API accepting an unlimited number of detectors, which could exhaust Kibana server resources #291203.

fixFix the field statistics flyout in the anomaly detection job wizard closing on its own while the wizard validates the job #292297.

9.4.7 Sep 15, 2026 Release notes ↗

securityFixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym…

securityFixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

fixFix alerting resource installation using unbounded concurrency, which could exhaust Kibana heap when many contexts and namespaces install at once #287643.

fixFix the Additional fields editor on the ServiceNow ITSM, ServiceNow SecOps, and Jira connectors rejecting Mustache context variables as invalid JSON #286578.

fixFix the Update filter button being unreachable when the filter editor is taller than the screen #289163.

fixFix Options list filters stopping after you delete a collapsible dashboard section #287923.

fixFix Canvas functions API creating data tables with more than 50 columns per row #287935.

fixFix the Maps timeslider close button registering clicks only on the top quarter of the control #287441.

fixFix Fleet blocking a package policy save when every enrolled agent is incompatible with the package version, including agents that report a pre-release version. Fleet shows a warning instead of blocking the save #289596.

fixFix managed integrations appearing in the Fleet Agents list when they use a version-specific policy #289394.

fixFix package policy space assignments becoming stale after you move an agent policy to another Kibana space #288966.

fixFix Elastic Defend metadata transforms accumulating as duplicates in Elasticsearch across stack upgrades #288379 #288902.

fixFix comment-only values in Fleet agent policy advanced YAML settings leaving agents stuck on an outdated policy #288430.

fixFix stale version-specific Fleet policies remaining after their agent version dropped out of the bounded set, and refresh variants that still have enrolled agents #287095.

fixFix the version-specific policy icon showing on agents that already meet the policy's version requirements #287504.

fixFix managed integration orphan cleanup so it respects package-policy ownership and the force flag #287571.

fixFix Fleet package policies keeping stale secret references after you rotate credentials #287642.

fixFix slow Fleet outputs fetching on Fleet setup and Integrations UI page load #287113.

fixFix classic streams leaving a stale Elasticsearch data stream mappings override after you remove all field overrides #288788.

fixFix Console treating request-like lines inside an unterminated triple-quoted string as standalone requests #287547.

fixFix Console body autocomplete preferring a same-name global rule over an explicit field rule #286703.

fixAdd an Expand role members toggle to ServiceNow connectors for compact document-level security #288071.

fixFix unexpected logouts after an access token is refreshed during a search or dashboard refresh #286038.

fixFix audit log records omitting the client IP address for requests made over HTTP/2 #285344.

9.4.6 Sep 1, 2026 Release notes ↗

securityFixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…

securityFixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…

securityFixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…

securityFixes CVE-2026-72682: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Age…

securityFixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…

securityFixes CVE-2026-72641: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only…

securityFixes CVE-2026-78597: Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica…

securityFixes CVE-2026-78603: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal…

securityFixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two…

featureAdd [Elastic Cloud Trial] prefix to email subjects sent through the built-in Elastic Cloud email service on trial deployments #276705.

featureAdd step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.

fixFix Agent Builder entering an infinite retry loop and hitting a recursion error when the plain-text answering path receives an empty model response #285823.

fixFix Anthropic inference endpoint stream parsing and Agent Builder silent retry loops on empty model responses #281616.

fixFix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when cross-cluster search index patterns are configured without the remote cluster client role #281609.

fixFix Anthropic inference endpoint requests sending temperature: 0 when no temperature was configured, causing unexpected model behavior in Agent Builder #281179.

fixFix alert suppression creating duplicate alerts when stored alerts use nested _source fields instead of flat dot-notation keys #282192.

fixFix by-reference Lens panels being removed from dashboards when their saved object references are missing #285476.

fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.

fixRemove the proxy configuration option from Kafka outputs, which don't support it #282313.

fixFix duplicate Cut, Copy, and Paste entries appearing in the Console context menu #286704.

fixFix Console autocomplete inserting boolean and numeric values as quoted strings instead of JSON primitives #286699.

fixFix Console body autocomplete failing after closed triple-quoted string values #286695.

fixFix Console autocomplete not triggering at request body positions, and correct template expansion and text corruption bugs when accepting suggestions #284530.

fixFix Console incorrectly showing autocomplete suggestions inside non-query triple-quoted strings #282424.

fixFix numeric field formats adding a sign prefix to values that round to zero #282919.

fixFix the percent field format displaying NaN when fractional is set to false #282915.

fixFix server-side date field formatting not reflecting timezone or pattern changes until Kibana is restarted #282501.

fixFix the Base64 Decode field format transform on the server side and for UTF-8 encoded data #281366.

fixFix PKI authentication sessions being unexpectedly invalidated when in-flight HTTP/2 requests are canceled, logging users out on TLS-enabled deployments #285153.

fixFix the Roles management page allowing navigation without warning when there are unsaved changes #283525.

fixFix Kibana failing to start when the audit log file location is misconfigured, and instead report a degraded state #282347.

fixFix the Data Frame Analytics results explorer not updating when switching to a different job of the same type #284964.

fixRestrict the trained model pipeline test endpoint to admin-level capabilities to prevent unauthorized data access #282002.

fixFix CSV exports generated by internal users (such as Fleet agent exports) failing with a parsing_exception error when xpack.reporting.csv.scroll.strategy: scroll is configured #286119.

fixFix the workflow editor blocking the Enabled toggle with an error when a foreach loop collection type cannot be statically proved #283360.

9.4.5 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-72665: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by…

securityFixes CVE-2026-72670: A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se…

securityFixes CVE-2026-72672: The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account ins…

securityFixes CVE-2026-72669: The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authentic…

securityFixes CVE-2026-72658: Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf…

securityFixes CVE-2026-72675: Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its…

securityFixes CVE-2026-72632: Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r…

securityFixes CVE-2026-72643: Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A…

securityFixes CVE-2026-72629: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i…

securityFixes CVE-2026-72630: Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in…

securityFixes CVE-2026-72666: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no a…

securityFixes CVE-2026-72644: Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use…

securityFixes CVE-2026-63138: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affe…

securityFixes CVE-2026-72676: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i…

securityFixes CVE-2026-72680: Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a…

securityFixes CVE-2026-72667: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica…

securityFixes CVE-2026-72659: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki…

securityFixes CVE-2026-72660: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…

securityFixes CVE-2026-72663: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV…

securityFixes CVE-2026-72664: Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-…

securityFixes CVE-2026-72651: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a…

securityFixes CVE-2026-72631: Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that t…

securityFixes CVE-2026-49089: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope…

securityFixes CVE-2026-78601: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operati…

securityFixes CVE-2026-72671: A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal…

securityFixes CVE-2026-72650: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…

securityFixes CVE-2026-72655: Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of…

fixFix auto-created conversations overwriting an existing conversation that shares the same ID #280189.

fixFix attaching AIOps charts (change point, pattern analysis, log rate analysis) to a case failing with an "Attachment type is not registered" error #281157.

fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, the corrected behavior applies only to reports created or re-saved after upgrading; existing schedules keep their previous time-window behavior until they are recreated…

fixFix the alerts-as-data setup overriding an index's total fields limit that was already set to a higher value #277402.

fixFix duplicated Lens panels backed by a form-based ad hoc data view failing to load after you rename the data view or add a runtime field, caused by colliding ad hoc data view IDs #281786.

fixFix ad hoc data view resolution for Lens XY annotation layers created through the Visualizations API #281079.

fixFix the Visualizations API dropping the custom display name of inline (ad hoc) data views on round trip #280546.

fixFix dashboard PDF exports using a stale time range after you change the time picker when the dashboard does not save the time range #278262.

fixFix Fleet output edits failing with a validation error when more than 10 hosts were configured, by raising the host limit from 10 to 100 for Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs #282397.

fixFix the expiration parameter on POST /enrollment_api_keys being silently dropped, and add an Expiration field to the Create enrollment token form in Fleet #281324.

fixFix OpenTelemetry integration metrics not defaulting to the time_series index mode #281295.

fixFix the agent policy filter on the Agents list returning no agents for version-specific policies #281195.

fixFix the Add Fleet Server onboarding continuing to show after the Fleet Server agent moves to a version-specific policy #281092.

+13 more items in the release notes

9.4.4 Jul 21, 2026 Release notes ↗

securityFixes CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by th…

securityFixes CVE-2026-72681: Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's func…

securityFixes CVE-2026-72661: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability use…

securityFixes CVE-2026-72653: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage mainte…

securityFixes CVE-2026-63260: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of…

securityFixes CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to…

securityFixes CVE-2026-63139: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource c…

securityFixes CVE-2026-42397: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r…

securityFixes CVE-2026-63141: Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requ…

securityFixes CVE-2026-78598: Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth…

securityFixes CVE-2026-72673: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv…

securityFixes CVE-2026-63142: Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra…

securityFixes CVE-2026-78584: Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-qu…

securityFixes CVE-2026-63262: Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

securityFixes CVE-2026-63143: Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outpu…

securityFixes CVE-2026-63145: Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1…

securityFixes CVE-2026-63259: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces t…

featureAdds a cases.pushCases workflow step that pushes the given cases to their external connectors #267539.

featureAdds an optional dryRun flag to Fleet bulk agent API endpoints so callers can preview how many agents would be affected without writing changes #276377.

featureSupports overriding data_stream.type in the simplified package policy API for input-only packages, so collected data can be routed to a different index prefix with matching agent index permissions #269895.

featureAdds a MongoDB connector datetime_conversion setting so syncs can clamp, convert, or error on dates outside the supported range instead of always aborting #277685.

fixImproves the Cases file upload modal with human-readable size limits, clearer unsupported-type messaging, per-file size checks, and error state that clears when a new file is selected #277567.

fixFixes OAuth client credentials token parsing so any 2xx response is treated as success #276321.

fixDefaults a missing reporting job version parameter to the current Kibana version instead of showing a hardcoded 7.14.0 value #275469.

fixFixes ES|QL query rules dropping parentheses when appending a limit, which could change calculated results #275231.

fixFixes Save and return for Lens visualizations embedded from the Cases editor so the comment updates correctly #275117.

fixExtracts observables automatically when alerts are attached to a case through the comments API #274969.

fixPreserves context.sourceFields from the active alert in Elasticsearch query rule recovery actions so recovery templates can still reference those field values #274686.

fixFixes the Google Drive connector so it can find and read files owned by a shared drive #274303.

fixLimits the Canvas createTable expression rowCount to a maximum of 10000, matching the default Elasticsearch index.max_result_window #276502.

fixFixes startup crashes from occurring when upgrading Kibana if a previous version's node.options file was preserved, caused by server-side imports of the browser-only @elastic/charts library #276284.

fixFixes horizontal padding in the Lens dimension editor #275993.

fixFixes the filter popover so that closing the context menu when saving a dashboard doesn't discard changes #275987.

fixFixes invisible field names in the Lens field picker when in dark mode #275785.

fixFixes incorrect color rendering for non-custom palettes in Lens metric charts #275203.

fixFixes color rendering in Lens gauge charts so a color band no longer extends past the configured range, and palette continuity is preserved on save #272123.

fixFixes resetting preconfigured agent policies aborting with a 404 on deployments where space awareness is disabled #276742.

fixFixes integration policy updates always bumping associated agent policy revisions, even when bumpRevision is false #275626.

fixDeletes orphaned multiple-isolated saved objects before package import to prevent ambiguous_conflict errors that blocked integration install or upgrade #275552.

fixFixes adding content connectors from Integrations so the enrollment flyout links to connector setup instead of waiting for incoming data #274832.

+24 more items in the release notes

9.4.3 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-63137: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissio…

securityFixes CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal…

securityFixes CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a…

securityFixes CVE-2026-56147: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inc…

securityFixes CVE-2026-78599: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C…

securityFixes CVE-2026-56151: Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is…

securityFixes CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)…

securityFixes CVE-2026-56146: Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated us…

securityFixes CVE-2026-49092: Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under…

featureAdds xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control the Elasticsearch index.mapping.total_fields.limit on .alerts-* indices, index templates, and component templates. Raise this above the current alert mapping field count to prevent mapping-update failures…

fixFixes ES|QL query escaping in the Dashboard skill's visualization config generation, ensuring patterns such as GROK retain the correct escape levels when queries are embedded as JSON #272493.

fixFixes the Stack Alerts page triggering two search cycles on initial load when filter controls are present, which could cause a brief flash of unfiltered results #271441.

fixFixes dashboard filters not being applied after collapsing a section that was expanded on initial load #272751.

fixFixes dashboards with panel or filter arrays that exceed schema size limits failing to load, by removing the array-size ceiling from internal read requests #271326.

fixImproves dashboard load resilience by validating each state key independently, dropping invalid panels, filters, or queries with warnings rather than failing the entire load #270300.

fixIncreases the maximum number of combined panels, sections, and controls on a dashboard from 100 to 1,000 #272931.

fixFixes Save and return not working for Maps visualizations opened from the Visualize library #274002.

fixFixes a stale closure in the Canvas autoplay timer that could skip pages after slides are added or removed #268398.

fixDisables the experimental Defer loading panels below "the fold" dashboard setting (labs:dashboard:deferBelowFold) because enabling it can cause some dashboards to fail to load. The option remains in Advanced Settings but has no effect from this version. It might be enabled again in a future…

fixRemoves the Content Connectors page from the menu for users who didn't have the appropriate role privileges #271709.

fixImproves POST /api/fleet/setup performance for deployments with many configured outputs by fetching only the required outputs instead of decrypting all saved outputs on each call #273848.

fixOptimizes the agent policies list endpoint (withAgentCount=true) to compute agent counts using a single aggregation instead of multiple queries per policy, greatly improving response time for large deployments #272429.

fixPrevents the agent version check from hanging indefinitely in air-gapped or firewall-restricted environments, and adds xpack.fleet.productVersionsApiTimeoutMs (default: 60 s) to control the request timeout #272715.

fixFixes variable leakage and duplication across policy templates in input packages that define multiple policy templates #273364.

fixIncludes input packages in the Integrations Signal type filter #272585.

fixFixes security rule names not displaying in the integration Assets accordion #272089.

fixFixes the agent logging level dropdown not updating after clicking Reset to policy on the agent Settings tab #271964.

fixFixes broken asset references in the integration Assets tab when an integration is reinstalled or upgraded from a different Kibana space #271800.

fixFixes per-integration output overrides for OpenTelemetry (OTel) integrations, and now raises a validation error when an unsupported output type is assigned instead of failing silently #270487.

fixFixes null and undefined field values in the ES|QL document summary column incorrectly counting toward the discover:maxDocFieldsDisplayed limit, which caused fields with real values to be hidden #273610.

fixFixes the Extend action icon in the Background searches panel being invisible in dark mode #272754.

fixFixes Discover session panels in dashboards failing to load after Copy to Spaces or import when the target space already contains remapped sessions #272610.

fixFixes a regression where KQL autocomplete suggestions stopped working in the ES|QL editor #273931.

fixFixes editing of object fields in the ES|QL lookup index editor when using dot-notation column names #273303.

fixAdds notifications.connectors.default.email as a Docker environment variable #272761.

fixFixes user profile retrieval in reverse proxy run_as configurations, ensuring the nav bar displays the effective user's avatar and name rather than the proxy user's #271314.

fixFixes product documentation installation timing out when the ML inference endpoint scales up from zero replicas (cold-start), and improves error messages when installation fails #270005.

fixLogs Dev Tools Console requests through the elasticsearch.query debug logger (method, path, and response status; request bodies are not included since Console streams them), and adds support for URL path prefixes in elasticsearch.hosts for Console proxy requests #271562.

fixFixes workflow executions that become orphaned from Task Manager now being cancelled immediately rather than waiting indefinitely for an asynchronous cancel #272672.

9.4.2 May 28, 2026 Release notes ↗

securityFixes CVE-2026-78592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low…

securityFixes CVE-2026-78586: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could…

securityFixes CVE-2026-49095: Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent…

securityFixes CVE-2026-42400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo…

securityFixes CVE-2026-49096: Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when…

featureImproves the Add inference endpoint and Edit inference endpoint flyouts with clearer titles, a footer Save button, task type descriptions in the selector, always-visible endpoint ID and API reference fields, and inline validation for required fields #262143.

fixFixes an issue that caused rules with large action parameter payloads to fail when saving or executing #269467.

fixFixes case workflow templates resolving from the wrong owner #268719.

fixFixes phrase search in the All Cases view #266827.

fixFixes the email connector to reject malformed email addresses (for example, local parts or domain labels with leading or trailing hyphens) that mail servers would reject, preventing unnecessary SMTP connection attempts #268496.

fixFixes HTTP connector TLS options when connecting through proxies #269898.

fixFixes client-side navigation in the content connectors UI to honor server.basePath and space URL prefixes, preventing 404s on connector detail tabs and after creation #269571.

fixFixes the links panel transform to remove an unsupported enhancements property #270230.

fixFixes the Lens API so XY charts with legends at the top or bottom return the correct configuration #268729.

fixFixes the Lens Visualization API rejecting rank_by with operation: "count" on terms buckets when no field is specified, so Count can rank by all documents without a field #268620.

fixFixes the Visualization API to correctly show default datatable colored badges #268425.

fixFixes gauge chart min, max, and goal configuration to reject unsupported reference-based metric operations (moving_average, differences, cumulative_sum, counter_rate) that require a date histogram #268168.

fixParses top-level elasticsearch fields in integration packages on upgrade or reinstall #269080.

fixFixes the agent enrollment Confirm incoming data step timing out for integrations that ingest backdated data by checking event.ingested instead of @timestamp #268224.

fixPreserves the expanded document selection after refresh when comparing documents in Discover #268328.

fixAllows null in CASE() expressions combined with other types #269051.

fixFixes missing modal and popover labels for screen readers across Stack Management UIs #269652.

fixFixes File upload not disabling data view creation when the user lacks data view creation capabilities #268167.

fixMakes the with block optional in workflow YAML for connector steps that have no required parameters #269047.