Kibana 9.5.2 → 9.5.6
4 releases · 0 breaking changes · 4 security fixes · 4 advisories fixed
4security0breaking0deprecated7feature136fix
Vulnerabilities fixed by this upgrade
- 6.5 CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…
- 8.8 CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym…
- 6.5 CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
- 8.1 CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li… in 9.5.5
- security Fixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… in 9.5.4
- security Fixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… in 9.5.3
- security Fixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.3
Every release in between
featureAdd options to include frozen tier data in Agent Builder tools. Frozen tier data stays excluded unless you opt in #297481, #299437.
featureSort agent policies alphabetically in the Assign new policy to agent modal #296067.
featureClarify in the Salesforce connector's document-level security tooltip that access applies per object type, not per record #297728.
featureAdd the i18n.detectBrowserLocale setting. Set it to false to stop Kibana from choosing the interface language from the browser's language preferences, while still letting you pick your own language #295756.
fixFix Agent Builder agents refusing to run ES|QL queries with execute_esql when the queries don't come from generate_esql, such as queries written in custom instructions or skills #300045.
fixFix ES|QL queries in Agent Builder failing on clusters that lack the remote cluster privilege, even when no remote clusters are requested #295560.
fixFix the Agent Builder natural language search tool querying indices that aren't allowed to the tool. The tool now returns an error when no allowed indices are available #295885.
fixFix bulk import not letting you select MCP tools that have no description #300886.
fixFix rules creating duplicate alerts, and leaving the original alerts active, when a rule run stops before it saves its state #293521.
fixFix rules and background tasks silently stopping for several minutes when a concurrent update prevents their completed run from being recorded #295415.
fixFix recurring tasks with rrule schedules running the same occurrence twice, or getting stuck after a timeout #297486.
fixFix the dashboard top menu and Edit button not appearing in embedded dashboards when show-top-menu=true is set #299599.
fixFix Lens metric panels failing to render when filters return no results and dynamic coloring uses a maximum dimension #297429.
fixFix an invalid-column error when you add a Maximum value dimension to an ES|QL metric visualization in Lens #296545.
fixFix Lens ES|QL metric background trendlines failing for queries with multiple piped STATS commands #294577.
fixFix Lens ES|QL metric background trendlines failing when the time field is renamed before aggregation #297591.
fixFix Lens as code range columns dropping open bounds, including ranges with no lower bound, no upper bound, or neither #300099.
fixFix Lens as code terms columns ranked by a custom last_value metric losing the sort field in the API round trip. The API now accepts an optional time_field on the custom rank-by #292378.
fixFix the dashboard API dropping ES|QL Lens panels whose color mapping assigns colors to boolean, null, multi-value, or open-ended range values #298850.
fixFix the Save and return button appearing instead of Save when you create a visualization #296261.
fixFix an agent policy showing an outdated minimum Elastic Agent version after you upgrade several integration policies at once #294439.
fixFix integration policy edits not reaching Elastic Agent for packages that declare their Elastic Agent version requirement in the package manifest #296354.
fixFix agents enrolled by an older Fleet Server being left on a deleted version-specific agent policy #295107.
fixFix automatic integration policy upgrades redeploying the agent policy once for each integration policy, which slowed upgrades and could make them time out when the Elastic Package Registry is unreachable #294411.
fixFix integrations whose default deployment option is Elastic Managed Integration saving an agent-based policy when they also have a cloud connector option #299039.
fixFix deleting an agent policy silently leaving its ID in shared integration policies. The delete now fails with an error that explains the cause #300189.
fixFix Fleet bulk agent action APIs not validating the agents input consistently. Invalid input now returns a 400 error instead of running the action #299837.
fixFix the managed integration enrollment flyout not showing component health details, and the Details action being unavailable for managed integration policies #294970.
fixFix the Agent policies page taking tens of seconds, or failing with an HTTP 500 error, when agent policies contain thousands of integration policies #297979.
fixFix agent policies for managed integrations appearing in agent policy searches and filters when Show agentless agents and policies in Fleet is turned off #296087.
fixFix Fleet rejecting integration policies whose data_stream.dataset uses an agent variable placeholder such as ${env.NAME} #295496.
fixFix Fleet running Elasticsearch transforms from uploaded integration packages with Kibana's internal system identity. Transforms in uploaded packages now run as the user who installed the package #297771.
fixFix scheduled unenrollment not deactivating inactive agents that have a stale unenrolled_at value #300148.
fixFix Fleet setup tripping the Elasticsearch request circuit breaker on deployments with large agent policy documents #300777.
fixFix Fleet hanging when the Elastic product versions API stops responding. The lookup of available Elastic Agent versions now honors its timeout and falls back to the versions bundled with Kibana #292736.
fixFix installed integration icons rendering as black shapes #293176.
fixFix the runtime field editor ignoring Save when you edit a field's script while the preview is still updating #294753.
fixFix the runtime field editor discarding the script when you change the field type to or from composite #299025.
fixFix the runtime field preview not showing a field's custom label, and the preview row disappearing while documents load #299810.
fixFix saved object labels showing "index patterns" instead of "data views" when you copy a dashboard that references data views in another space #297621.
+22 more items in the release notessecurityFixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…
fixFix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.
fixFix Agent Builder tracing applying the default space's GenAI privacy settings in every space. Each conversation now uses the privacy settings of its own space #290750.
fixAdd the case template ID and version fields to the Agent Builder cases-analytics skill so agents can filter and group cases by template #291716.
fixFix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.
fixFix Agent Builder rules failing after about an hour because they kept the agent's temporary API key #291318.
fixFix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874.
fixFix Jira Service Management and Opsgenie connector actions failing when the rendered alert message exceeds 130 characters. The connectors now truncate the message instead #291698.
fixFix the email connector HTTP test sending caller-supplied subject and message content. The test now sends fixed content #288664.
fixFix the Auto-push case to connected external system option missing from the Cases rule action when case templates are enabled #292187.
fixIncrease the TinyMath expression length limit so longer visualization formulas don't fail #290314.
fixFix Go to URL drilldowns leaving Mustache tokens such as event.values.[0] unreplaced in the drilldown name #290363.
fixFix ES|QL metric chart background trendlines failing for queries that use FORK #287819.
fixFix new Last value columns being exported with Show array values turned on even when the option is off, which caused Elasticsearch errors when you imported them #292864.
fixFix filter pills showing filter value is invalid or incomplete when the filter value is an empty string #290383.
fixFix clicking the unsaved changes indicator on the dashboard save button opening two save dialogs #293087.
fixFix deleting a managed integration policy leaving the agent listed as active #290181.
fixFix agents for Elastic managed integrations enrolled in other Kibana spaces appearing in the Fleet Agents list #293142.
fixFix version-specific agent policy assignment failing repeatedly for agent policies in non-default Kibana spaces #293010.
fixFix the Fleet output edit flyout freezing or showing no counts when thousands of agent policies use the output #291972.
fixFix Elastic Agent upgrade and agent policy requests hanging for up to two minutes and failing with a reset connection when Kibana can't retrieve the list of available Elastic Agent versions #292788.
fixFix integration upgrades failing when you add a custom analyzer or normalizer to a @custom component template after the write index is created. Fleet now rolls over the data stream instead #291813.
fixFix Fleet installing only the first trained model when an integration package includes several #290145.
fixFix ambiguous_conflict errors on dashboard assets when you install an integration in multiple Kibana spaces #291648.
fixFix integration policy upgrades and edits failing when a package policy condition is stored as a boolean #290497.
fixFix Fleet showing an error when you delete an OpenTelemetry input integration policy that shares a dataset with another policy #291679.
fixFix the Edit pipeline button in the ingest pipeline details flyout moving off-screen when a processor contains a long value #291000.
fixFix Index Management moving component templates listed in ignore_missing_component_templates to the end of composed_of when you edit or clone an index template #290171.
fixFix Index Management showing Standard as the index mode of time series data streams instead of the mode Elasticsearch reports #290169.
fixFix the document trends chart and its URL getting out of sync on the data set quality details page when you select a quality card while the page loads #291004.
fixFix Console reporting Elasticsearch request timeouts as connection failures. Console now explains that the request might still be running and suggests checking its status before you retry #289481.
fixFix Discover ES|QL breakdowns failing when a second STATS groups by an aggregate from the first STATS #290259.
fixAdd an Expand site group members toggle to SharePoint Online connectors for compact document-level security #288070.
fixAdd a Sync all mail folders option to the Outlook connector #291396.
fixAdd an Index full raw email (including headers) option to the Gmail and Outlook connectors, which by default index only the message body and minimal headers #291419.
fixFix deleted content connectors remaining in the connectors list #290859.
fixHide the Activate user action on deactivated users when you have read-only access #289801.
fixFix a failed audit log write after startup crashing Kibana. Kibana now reports a degraded state and turns the audit logger off instead #287360.
fixFix Kibana shutting down when the product documentation installer downloads a corrupt or incomplete artifact #291142.
fixFix PDF and PNG reports using too much memory and failing on memory-constrained instances when you generate them from a wide browser window #289062.
+8 more items in the release notessecurityFixes CVE-2026-102406: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym…
fixFix MCP tools dropping extra arguments that the schema allows through additionalProperties before execution #287815.
fixRelabel the top-level Alerting privilege as Alerting V2 in the Roles UI and mark it experimental #288163.
fixFix the Tracking containment rule editor breaking when you select a data view #289778.
fixFix Sync alerts and Extract observables not applying when you change a case template from the sidebar #288636.
fixFix Alerting V2 rules from not saving when you remove all rule tags #288962.
fixFix the Update filter button being unreachable when the filter editor is taller than the screen #289163.
fixFix sibling dashboard panels not dimming during inline editing on dashboards that have no controls #288939.
fixFix ES|QL visualizations dropping field variable controls (??field) after you save them through the Visualizations API #288785.
fixFix Options list filters stopping after you delete a collapsible dashboard section #287923.
fixFix Fleet blocking a package policy save when every enrolled agent is incompatible with the package version, including agents that report a pre-release version. Fleet shows a warning instead of blocking the save #289596.
fixFix managed integrations appearing in the Fleet Agents list when they use a version-specific policy #289394.
fixFix package policy space assignments becoming stale after you move an agent policy to another Kibana space #288966.
fixFix Elastic Defend metadata transforms accumulating as duplicates in Elasticsearch across stack upgrades #288379 #288902.
fixFix comment-only values in Fleet agent policy advanced YAML settings leaving agents stuck on an outdated policy #288430.
fixFix classic streams leaving a stale Elasticsearch data stream mappings override after you remove all field overrides #288788.
fixFix Console treating request-like lines inside an unterminated triple-quoted string as standalone requests #287547.
fixCancel in-progress async searches in Discover and on dashboards when you navigate away in the browser, so Elasticsearch does not keep running them #287949.
fixFix custom time-range presets from the Time filter quick ranges advanced setting showing raw time values instead of their labels, and add a (rounded) suffix to rounded relative ranges #289066.
fixAdd an Expand role members toggle to ServiceNow connectors for compact document-level security #288071.
fixFix Query Rules document preview failing when the document ID contains slashes #287214.
fixFix unexpected logouts after an access token is refreshed during a search or dashboard refresh #286038.
fixFix user profile rows using the wrong height in user pickers #288451.
fixFix Anomaly Explorer hanging when you add a geo job chart to a case #289363.
securityFixes CVE-2026-78583: Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa…
securityFixes CVE-2026-94400: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
featureWarn in the field library and template editors when a required case field has no default value, because automated case creation can't fill it in, and show a field's name and type as permanent as soon as you create it #285453.
featureEnforce required global fields on API and workflow case creation when case templates are enabled, and accept extended_fields on the public and workflow case create and update APIs #283350.
featureRaise the Dev Tools Console Copy to curl limit so a request-body string of up to 100000 characters copies successfully #287526.
fixFix the research agent re-asking clarifying questions you already answered in the same round #284800.
fixFix disabled pre-execution workflows disappearing from Agent Builder settings so you cannot remove them. A disabled workflow stays visible and is labeled (disabled) #286826.
fixFix legacy custom fields and their v2 field-definition counterparts falling out of sync, by linking each legacy field to its definition and keeping both representations equal on every write #282772.
fixFix cases created from a case template by a rule action not inheriting the template's external connector, Sync alerts and Extract observables settings, and assignees #284854.
fixFix matching fields missing from Cases Activity search results #284940.
fixFix case attachment UI issues, including delete controls on saved-object attachments and the more-actions menu for read-only access #285456.
fixFix saved Lens visualizations missing from case attachments, and add helper text in the markdown editor for inline Timeline and Lens references #286164.
fixFix creating a case from a workflow, a case template, or machine learning so Sync alerts is not turned on unless that solution enables it #286670.
fixFix the Additional fields editor on the ServiceNow ITSM, ServiceNow SecOps, and Jira connectors rejecting Mustache context variables as invalid JSON #286578.
fixFix required-on-close validation skipping global fields that a template includes by $ref #287306.
fixFix a template $ref global field ignoring its hide-on-value condition when the controlling field is in another section #287308.
fixFix global field column selections not syncing between the Cases list and table views #287327.
fixFix the Cases list keeping the previous page after you change filters #287945.
fixFix custom threshold no data alerts firing for groups that belong to a different custom threshold rule #287151.
fixFix custom threshold Rate aggregations not firing when a counter increases from 0 to a positive value #283973.
fixFix experimental alerting system .rule-events and .alert-actions data streams requesting a replica on single-node clusters, which left those shards unassigned #287544.
fixFix alerting resource installation using unbounded concurrency, which could exhaust Kibana heap when many contexts and namespaces install at once #287643.
fixFix by-reference visualization panels disappearing from dashboards when the panel's savedObjectRef reference is missing #285476.
fixFix metric chart background trendlines failing for ES|QL time-series queries that use TBUCKET(...) #284839.
fixFix the Maps timeslider close button registering clicks only on the top quarter of the control #287441.
fixFix Canvas functions API creating data tables with more than 50 columns per row #287935.
fixFix package policy inputs for newer agent versions not being backfilled after a Kibana minor upgrade #284710.
fixAvoid querying Elasticsearch for integration sync when no cross-cluster replication follower index exists #285526.
fixFix space awareness on Fleet agent tag, upload, file, and unenroll API handlers #284936.
fixFix Fleet wrapping a Kafka Dynamic topic multi-field format string such as %{[data_stream.type]}-%{[data_stream.namespace]}, which produced an invalid topic expression #285581.
fixFix Fleet package manifests accepting cluster privileges outside the documented allow list #286084.
fixFix Fleet agent CSV export failing when xpack.reporting.csv.scroll.strategy is scroll, or when Search in frozen indices is enabled #286119.
fixFix the Fleet agent-status-change task failing when the Elasticsearch response is too large #286324.
fixFix sorting the Agents table by Host so it uses the hostname keyword field instead of the analyzed text field #286383.
fixFix package policies accepting a whitespace-only namespace, which saved while ingestion failed silently #286385.
fixFix the CPU and memory tooltip on offline agents showing misleading messages instead of clearly stating the agent is offline #286386.
fixFix managed integration throughput index patterns for streams that use a dynamic dataset #286758.
fixFix update and delete of legacy managed integration policies returning HTTP 404 or reporting success while the deployment kept running #287011.
fixFix stale version-specific Fleet policies remaining after their agent version dropped out of the bounded set, and refresh variants that still have enrolled agents #287095.
fixFix slow Fleet outputs fetching on Fleet setup and Integrations UI page load #287113.
+21 more items in the release notes