Kibana 9.5.4 → 9.5.6
2 releases · 0 breaking changes · 1 security fix · 1 advisory fixed
1security0breaking0deprecated4feature76fix
Vulnerabilities fixed by this upgrade
- 6.5 CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li… in 9.5.5
Every release in between
featureAdd options to include frozen tier data in Agent Builder tools. Frozen tier data stays excluded unless you opt in #297481, #299437.
featureSort agent policies alphabetically in the Assign new policy to agent modal #296067.
featureClarify in the Salesforce connector's document-level security tooltip that access applies per object type, not per record #297728.
featureAdd the i18n.detectBrowserLocale setting. Set it to false to stop Kibana from choosing the interface language from the browser's language preferences, while still letting you pick your own language #295756.
fixFix Agent Builder agents refusing to run ES|QL queries with execute_esql when the queries don't come from generate_esql, such as queries written in custom instructions or skills #300045.
fixFix ES|QL queries in Agent Builder failing on clusters that lack the remote cluster privilege, even when no remote clusters are requested #295560.
fixFix the Agent Builder natural language search tool querying indices that aren't allowed to the tool. The tool now returns an error when no allowed indices are available #295885.
fixFix bulk import not letting you select MCP tools that have no description #300886.
fixFix rules creating duplicate alerts, and leaving the original alerts active, when a rule run stops before it saves its state #293521.
fixFix rules and background tasks silently stopping for several minutes when a concurrent update prevents their completed run from being recorded #295415.
fixFix recurring tasks with rrule schedules running the same occurrence twice, or getting stuck after a timeout #297486.
fixFix the dashboard top menu and Edit button not appearing in embedded dashboards when show-top-menu=true is set #299599.
fixFix Lens metric panels failing to render when filters return no results and dynamic coloring uses a maximum dimension #297429.
fixFix an invalid-column error when you add a Maximum value dimension to an ES|QL metric visualization in Lens #296545.
fixFix Lens ES|QL metric background trendlines failing for queries with multiple piped STATS commands #294577.
fixFix Lens ES|QL metric background trendlines failing when the time field is renamed before aggregation #297591.
fixFix Lens as code range columns dropping open bounds, including ranges with no lower bound, no upper bound, or neither #300099.
fixFix Lens as code terms columns ranked by a custom last_value metric losing the sort field in the API round trip. The API now accepts an optional time_field on the custom rank-by #292378.
fixFix the dashboard API dropping ES|QL Lens panels whose color mapping assigns colors to boolean, null, multi-value, or open-ended range values #298850.
fixFix the Save and return button appearing instead of Save when you create a visualization #296261.
fixFix an agent policy showing an outdated minimum Elastic Agent version after you upgrade several integration policies at once #294439.
fixFix integration policy edits not reaching Elastic Agent for packages that declare their Elastic Agent version requirement in the package manifest #296354.
fixFix agents enrolled by an older Fleet Server being left on a deleted version-specific agent policy #295107.
fixFix automatic integration policy upgrades redeploying the agent policy once for each integration policy, which slowed upgrades and could make them time out when the Elastic Package Registry is unreachable #294411.
fixFix integrations whose default deployment option is Elastic Managed Integration saving an agent-based policy when they also have a cloud connector option #299039.
fixFix deleting an agent policy silently leaving its ID in shared integration policies. The delete now fails with an error that explains the cause #300189.
fixFix Fleet bulk agent action APIs not validating the agents input consistently. Invalid input now returns a 400 error instead of running the action #299837.
fixFix the managed integration enrollment flyout not showing component health details, and the Details action being unavailable for managed integration policies #294970.
fixFix the Agent policies page taking tens of seconds, or failing with an HTTP 500 error, when agent policies contain thousands of integration policies #297979.
fixFix agent policies for managed integrations appearing in agent policy searches and filters when Show agentless agents and policies in Fleet is turned off #296087.
fixFix Fleet rejecting integration policies whose data_stream.dataset uses an agent variable placeholder such as ${env.NAME} #295496.
fixFix Fleet running Elasticsearch transforms from uploaded integration packages with Kibana's internal system identity. Transforms in uploaded packages now run as the user who installed the package #297771.
fixFix scheduled unenrollment not deactivating inactive agents that have a stale unenrolled_at value #300148.
fixFix Fleet setup tripping the Elasticsearch request circuit breaker on deployments with large agent policy documents #300777.
fixFix Fleet hanging when the Elastic product versions API stops responding. The lookup of available Elastic Agent versions now honors its timeout and falls back to the versions bundled with Kibana #292736.
fixFix installed integration icons rendering as black shapes #293176.
fixFix the runtime field editor ignoring Save when you edit a field's script while the preview is still updating #294753.
fixFix the runtime field editor discarding the script when you change the field type to or from composite #299025.
fixFix the runtime field preview not showing a field's custom label, and the preview row disappearing while documents load #299810.
fixFix saved object labels showing "index patterns" instead of "data views" when you copy a dashboard that references data views in another space #297621.
+22 more items in the release notessecurityFixes CVE-2026-102412: Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with li…
fixFix Agent Builder tools hanging or timing out on data streams that span the frozen tier. Tools now skip frozen tier indices #292349.
fixFix Agent Builder tracing applying the default space's GenAI privacy settings in every space. Each conversation now uses the privacy settings of its own space #290750.
fixAdd the case template ID and version fields to the Agent Builder cases-analytics skill so agents can filter and group cases by template #291716.
fixFix forced rule runs and schedule changes being silently dropped when you request them while the rule is finishing a run #293492.
fixFix Agent Builder rules failing after about an hour because they kept the agent's temporary API key #291318.
fixFix bulk alert tag updates also changing matching alerts in other Kibana spaces #285874.
fixFix Jira Service Management and Opsgenie connector actions failing when the rendered alert message exceeds 130 characters. The connectors now truncate the message instead #291698.
fixFix the email connector HTTP test sending caller-supplied subject and message content. The test now sends fixed content #288664.
fixFix the Auto-push case to connected external system option missing from the Cases rule action when case templates are enabled #292187.
fixIncrease the TinyMath expression length limit so longer visualization formulas don't fail #290314.
fixFix Go to URL drilldowns leaving Mustache tokens such as event.values.[0] unreplaced in the drilldown name #290363.
fixFix ES|QL metric chart background trendlines failing for queries that use FORK #287819.
fixFix new Last value columns being exported with Show array values turned on even when the option is off, which caused Elasticsearch errors when you imported them #292864.
fixFix filter pills showing filter value is invalid or incomplete when the filter value is an empty string #290383.
fixFix clicking the unsaved changes indicator on the dashboard save button opening two save dialogs #293087.
fixFix deleting a managed integration policy leaving the agent listed as active #290181.
fixFix agents for Elastic managed integrations enrolled in other Kibana spaces appearing in the Fleet Agents list #293142.
fixFix version-specific agent policy assignment failing repeatedly for agent policies in non-default Kibana spaces #293010.
fixFix the Fleet output edit flyout freezing or showing no counts when thousands of agent policies use the output #291972.
fixFix Elastic Agent upgrade and agent policy requests hanging for up to two minutes and failing with a reset connection when Kibana can't retrieve the list of available Elastic Agent versions #292788.
fixFix integration upgrades failing when you add a custom analyzer or normalizer to a @custom component template after the write index is created. Fleet now rolls over the data stream instead #291813.
fixFix Fleet installing only the first trained model when an integration package includes several #290145.
fixFix ambiguous_conflict errors on dashboard assets when you install an integration in multiple Kibana spaces #291648.
fixFix integration policy upgrades and edits failing when a package policy condition is stored as a boolean #290497.
fixFix Fleet showing an error when you delete an OpenTelemetry input integration policy that shares a dataset with another policy #291679.
fixFix the Edit pipeline button in the ingest pipeline details flyout moving off-screen when a processor contains a long value #291000.
fixFix Index Management moving component templates listed in ignore_missing_component_templates to the end of composed_of when you edit or clone an index template #290171.
fixFix Index Management showing Standard as the index mode of time series data streams instead of the mode Elasticsearch reports #290169.
fixFix the document trends chart and its URL getting out of sync on the data set quality details page when you select a quality card while the page loads #291004.
fixFix Console reporting Elasticsearch request timeouts as connection failures. Console now explains that the request might still be running and suggests checking its status before you retry #289481.
fixFix Discover ES|QL breakdowns failing when a second STATS groups by an aggregate from the first STATS #290259.
fixAdd an Expand site group members toggle to SharePoint Online connectors for compact document-level security #288070.
fixAdd a Sync all mail folders option to the Outlook connector #291396.
fixAdd an Index full raw email (including headers) option to the Gmail and Outlook connectors, which by default index only the message body and minimal headers #291419.
fixFix deleted content connectors remaining in the connectors list #290859.
fixHide the Activate user action on deactivated users when you have read-only access #289801.
fixFix a failed audit log write after startup crashing Kibana. Kibana now reports a degraded state and turns the audit logger off instead #287360.
fixFix Kibana shutting down when the product documentation installer downloads a corrupt or incomplete artifact #291142.
fixFix PDF and PNG reports using too much memory and failing on memory-constrained instances when you generate them from a wide browser window #289062.
+8 more items in the release notes