Kibana 9.4.9 → 9.5.2
3 releases · 0 breaking changes · 5 security fixes · 0 advisories fixed
5security0breaking0deprecated51feature69fix
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… in 9.5.2
- security Fixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… in 9.5.2
- security Fixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… in 9.5.2
- security Fixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… in 9.5.2
- security Fixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… in 9.5.2
Every release in between
securityFixes CVE-2026-78608: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function…
securityFixes CVE-2026-72654: Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on…
securityFixes CVE-2026-72628: Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou…
securityFixes CVE-2026-72633: Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user…
securityFixes CVE-2026-78606: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two…
featureAdd a public API to create, update, and delete case templates (POST, PUT, and DELETE /api/cases/templates), including a dry-run mode that validates a template without saving it #280144.
featureImprove the Cases view, cases list, and field library by keeping the case details panel in view as you scroll, saving status and other fields immediately when changed, and adding drag-and-drop field reordering to the field library #282197.
featureAdd an Agent Builder tool to attach saved dashboards, maps, Discover sessions, and Lens visualizations to a case #279680.
featureRestore Defer loading panels below "the fold" (labs:dashboard:deferBelowFold) so off-screen dashboard panels wait to fetch data until they scroll into view. The setting is off by default #284004.
featureAdd a toggle to the Manage region preferences modal so you can remove a custom region policy and revert to allowing all regions #282769.
featureAdd step-level if skip conditions to all workflow step types except the if step, which continues to use condition #279210.
featureEnable running a workflow with only the execute privilege, without also requiring the read privilege on the workflow definition #284822.
fixFix missing screen reader announcements when toggling the Show active only filter on the agent tools page #282276.
fixFix Agent Builder queries failing with a security exception on Elasticsearch 9.4 when you configure cross-cluster search index patterns but the cluster doesn't have the remote cluster client role #281609.
fixFix chat completion streams continuing after you cancel a request, and cap their duration at 10 minutes #285119.
fixFix Agent Builder requests to Google Vertex AI inference endpoints failing when tool schemas include JSON Schema fields that Vertex doesn't accept #284810.
fixFix Agent Builder conversations failing when a prompt contains special tokens such as <|endoftext|>, or when Claude models receive empty text blocks #283177.
fixRestore legacy root-level inputs in Agent Builder workflow tool schemas so existing workflow tools keep working #285149.
fixFix concurrent conversations silently dropping a round when two clients replied at the same time. Case attachment requests that now conflict return HTTP 409 instead of appearing to succeed #281887.
fixFix agent custom instructions failing to save because the full edit payload was sent, which broke access control entries #277176.
fixFix visualizations generated from a specified index silently returning an empty chart when the query read from a different source. Agent Builder now retries once and then reports an error #282212.
fixFix the custom answer text field losing focus after you select its radio button when an agent asks a clarifying question #283326.
fixFix Cases free-text search failing when a case's extended fields produced too many runtime-field values #284475.
fixFix case Activity recording a row for every unchanged template or global field default when you create a case #284310.
fixFix assigning users to a case creating duplicate activity entries #284035.
fixFix field library toggle filters missing from More filters on the All cases page #283645.
fixFix duplicate required-on-close validation errors when a template references a global field that is also required on close #283922.
fixFix a template $ref field silently dropping its local display and validation overrides #283072.
fixPrevent changing a field definition's name or type after creation, which previously orphaned stored case values #282770.
fixResolve case field-definition references without regard to capitalization so renaming a field's casing no longer hides it from templates #282450.
fixFix global case field defaults not being applied to cases created through the API or workflow steps, and prevent the field-migration backfill from overwriting values you've already set or cleared #283185.
fixFix the case details Associated Users and Associated Hosts counts omitting directly attached user and host entities #283036.
fixFix the Alerting V2 update API rejecting a valid change of a signal rule's query format to composed #283754.
fixFix Lens metric trendline breakdown ordering to rank by the trendline's own metric instead of falling back to alphabetical order #283159.
fixFix histogram granularity to preserve the saved bar count instead of resetting to Auto above 7 bars. The effective ceiling remains the histogram:maxBars advanced setting #283058.
fixFix duration format to preserve decimal and compact settings on round-trip, except when using the automatic (auto-approximate) duration format #282815.
fixFix the dashboards list endpoint not sorting by last updated date in descending order when no search query is set #282363.
fixFix deleting a package policy from an agent policy with many agents blocking on a full synchronous redeploy instead of deploying asynchronously #282580.
fixFix Fleet bulk upgrades installing the bundled package version instead of the latest registry version #282829.
fixFix Fleet lookups that treated version-specific policy IDs as base policy IDs, which could return HTTP 404 for Fleet Server policy revisions and miss agents #283071.
+12 more items in the release notesfeatureAdd limits on case templates and fields (200 templates and 200 fields per owner, and size limits on template and field definitions) to keep large template libraries performant, and clean up the field library editor #281650.
featureStore assignee usernames, full names, and email addresses on cases so case analytics dashboards can show assignee details without an extra lookup. Available by default in traditional deployments #281579.
featureAdd an Import from another stream flow in the Data lifecycle tab to reuse another stream's lifecycle configuration #275948.
featureAdd transition animations to the Streams data lifecycle phase preview so editing or switching lifecycle methods no longer flashes between states #277149.
fixFix Agent Builder retrying indefinitely on repeated empty responses from Anthropic models, which could exhaust the conversation before surfacing an error #281616.
fixFix Anthropic chat completion requests unexpectedly setting temperature: 0 when no temperature was configured, which could cause errors for Agent Builder and Attack Discovery #281179.
fixFix the attachment input pill border color in Agent Builder chat #282279.
fixFix ES|QL truncating the Tool Success Rate panel in the Agent Builder overview dashboard to 0% whenever there was at least one failure #282026.
fixFix the all cases list and case activity log to render user-picker, toggle, and checkbox field values correctly, and hide markdown-only fields from the column picker #282870.
fixFix duplicate activity entries when setting legacy custom fields #282813.
fixFix the all cases table column selector and template activity log to read from global fields after migrating to case templates #282129.
fixFix duplicate field-definition records being created when a legacy custom field is edited multiple times #282060.
fixFix the case list metrics bar to reflect the current search, filters, and date range instead of showing unfiltered totals #280576.
fixPrevent deleting a field definition that is still referenced by an active case template #280493.
fixFix the timestamp field in the alerting rule query sandbox not updating after the first selection #281854.
fixFix bulk-disabling alerting rules leaving their background execution tasks running after the rule shows as disabled #281468.
fixFix terms formatting to preserve multi-field grouping and column format on round-trip #282760.
fixFix terms include and exclude values to preserve numbers instead of converting them to strings #282752.
fixFix a Lens panel failing to load after duplicating it and then modifying its ad hoc data view, caused by colliding data view IDs #281786.
fixFix a Visualizations API error when reading back an XY chart with an annotation layer backed by an ad hoc data view #281079.
fixFix the Visualizations API dropping the custom name of an ad hoc, form-based data view on round-trip #280546.
fixFix Metric chart values colored by a value outside the configured range to use the default text color instead of blending into the background #280816.
fixDisable Fast mode for Basic and Platinum licenses; approximate results in Discover and Dashboards require an Enterprise license #279903.
fixFix the dashboards listing page failing to load when the savedObjects:listingLimit advanced setting exceeds 1,000 #282100.
fixIncrease the maximum number of hosts allowed on Elasticsearch, remote Elasticsearch, Logstash, and Kafka outputs from 10 to 100 #282397.
fixRemove the proxy configuration option from Kafka outputs, which never supported it #282313.
fixFix a layout flash and unexpected switch to the Fleet app when you select Add integration from the Integrations app #281493.
fixFix enrollment API keys ignoring the requested expiration so tokens never expired regardless of the value you set #281324.
fixFix Fleet-managed OpenTelemetry metrics data streams to use time series index mode by default for integration packages #281295.
fixFix managed OTLP API keys being created without the required APM privileges, which caused the managed OTLP endpoint to reject events #281261.
fixFix the agent policy filter on the agents list page to match agents assigned to version-specific policies #281195.
fixFix Fleet Server detection to recognize agents assigned to version-specific Fleet Server policies, which could leave the onboarding screen showing indefinitely #281092.
fixFix Fleet secrets being stored inline instead of in the secrets index when package policies are created in bulk #282213.
fixFix the agent policy download endpoint returning an HTTP 500 error for policies that reuse the same permissions object in more than one place #280669.
fixFix ILM Explain data not returning results for hidden and system indices in Index Management #282137.
fixFix the Short Dots transform dropping single-character path segments, for example rendering a.b.c as a.c #281930.
fixAlign the null-value label for server-side date fields with the client so CSV exports and the UI both show (null) #281367.
fixFix the Date Nanos formatter ignoring the configured date format for numeric values, such as aggregation results #281343.
fixFix Geo point degrees-minutes-seconds output rounding near-zero coordinates up to a full degree #281336.
fixFix CSV exports covering a different time window than what was shown in Discover for relative time ranges. For scheduled reports, this applies only to reports created or re-saved after upgrading; existing schedules keep their previous behavior until recreated #278305.
+8 more items in the release notesfeatureCreate skills in Agent Builder chat, preview drafts in attachments, and save them from the conversation #265883.
featureEnable Agent Builder to pause and ask up to five clarifying multiple-choice questions before acting, then resume after you answer #274672.
featureShare private agents with selected people using per-agent access control alongside Public, Shared, and Private visibility #267530.
featureAdd an embeddable Agent Builder conversation input that opens Agent Builder and sends the message with attachments preserved #272166.
featureEnable Agent Builder tracing by default so you can view trace waterfalls for each response, use the built-in traces skill, and monitor activity in the overview dashboard while excluding sensitive prompts and tool parameters by default #276174.
featureAdd install, open, and delete controls to the Agent Builder Traces option on the GenAI Settings page, and prevent deleted dashboards from being reinstalled when Kibana restarts #276643.
featureSet a resizable custom width for Agent Builder attachment canvas flyouts in full-screen view and overlay mode in the sidebar #265200.
featureAdd optional connector_ids to the Agent Builder conversation API to limit which connectors a request can use #267333.
featureShow permitted system indices and aliases in Agent Builder index selection, including alerts, ML anomaly results, SLOs, the entity store, exception lists, SIEM signals, and Stack Monitoring #265819.
featureRun several Agent Builder conversations at the same time, and track each conversation's status in the chats panel with In progress, Awaiting your input, Unread, and Error indicators #267980 #271689.
featureRoute low-effort Agent Builder operations such as ES|QL generation and conversation title generation to a configurable fast model, set per feature in Feature settings, with automatic fallback to the default model #265520 #274849 #275607.
featureEnable Cases as Data by default so you can analyze cases, activity, and attachments through dedicated indices and a prebuilt Case Analytics data view that stays current as custom fields change without replacing the space's default data view #279831 #280001.
featureEnable the redesigned Cases list, details, and settings pages by default #279367.
featureSnooze and unsnooze individual alerts with optional expiry or auto-unsnooze conditions #264090.
featureAdd a Stack Alerts feature privilege so roles can read and act on alerts without rule management access #273804.
featureAdd an Inspect action to view and run the Elasticsearch query used by custom threshold rules from the rule details page #262354.
featureMove the unified Rules page into Stack Management so navigation context remains visible #269568.
featureSearch, summarize, and update cases from Agent Builder chat with a cases skill, tools, and case attachments #271438.
featureAdd Add to chat and Summarize case actions to the case details page #276635 #279105.
featureAttach Lens visualizations to cases from Attach saved object #274959 #277040.
featureAttach Discover sessions, dashboards, and maps to cases #272423.
featureRedesign case attachments with a unified Attachments tab, collapsible sections and item counts by type, Type and Author filters, Refresh, and an Attach action on the Activity and Attachments tabs #270518 #272759 #269560.
featureAdd a warning when a selected file already exists in a case #279327.
featureExtract case observables automatically when alerts are added through the API, workflows, or Agent Builder #273455.
featureImprove case templates with toggle fields, unique template names, and a simplified default starter template #277626.
featureSplit the case template editor into Fields and Configuration tabs #277269.
featureAdd autocomplete and inline validation to the case template YAML editor #279346.
featureSet default connectors and case settings in case templates #275690.
featureAdd a display-only Markdown field type to case templates #278329.
featureAdd public Cases APIs to discover applicable extended_fields and apply template defaults when creating a case #279684 #280143.
featureAdd xpack.alerting.alertsService.totalFieldsLimit (default 2800, range 2500–5000) to control Elasticsearch index.mapping.total_fields.limit on .alerts-* indices and templates #274024.
featureAdd a OneDrive connector to search files, browse drives, and read file content in Agent Builder and Workflows #275244.
featureAdd a Box connector to search files and folders and read file content in Agent Builder and Workflows #271306.
featureAdd an Outlook connector to search and browse email messages and download attachments in Agent Builder and Workflows #266766.
featureAdd a Snowflake connector to run SQL queries, explore databases and tables, and search with Cortex Search in Agent Builder and Workflows #264827.
featureAdd an Azure Blob Storage connector to list containers and blobs, read blob content, and search storage in Agent Builder and Workflows #259439.
featureAdd a HubSpot connector to search and retrieve contacts, companies, deals, tickets, and engagements in Agent Builder and Workflows #257675.
featureAdd a Sublime Security connector to investigate and act on email threats in Agent Builder and Workflows #279707.
featureAdd a Filter by feature control to the create-connector flyout, and show the HTTP connector in standard connector lists #271686.
featureImprove authentication options for Agent Builder connectors by listing recommended methods first with a Recommended badge and hiding legacy options when you create new connectors #273410.
+374 more items in the release notes