Is Kibana 8.0.1 affected?

Vulnerabilities affecting 8.0.1

• 9.1
  CVE-2024-37287 A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a protot… fixed in 8.14.2
• 8.8
  CVE-2023-31414 Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to exe…
• 8.7
  CVE-2025-25018 Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS) fixed in 8.18.8
• 8.7
  CVE-2025-25009 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. fixed in 8.18.8
• 8.2
  CVE-2025-25017 Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS) fixed in 8.18.8
• 8.1
  CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… fixed in 8.19.21
• 8.0
  CVE-2026-49091 Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written… fixed in 8.11.1
• 8.0
  CVE-2023-46675 An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has… fixed in 8.11.2
• 8.0
  CVE-2023-46671 An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error mes… fixed in 8.11.1
• 7.7
  CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… fixed in 8.19.20
• 7.7
  CVE-2026-4498 Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122… fixed in 8.19.14
• 7.7
  CVE-2026-33461 Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve… fixed in 8.19.14
• 7.6
  CVE-2024-43706 Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
• 7.3
  CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal… fixed in 8.19.18
• 7.3
  CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low… fixed in 8.19.16
• 7.3
  CVE-2026-72677 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a… fixed in 8.19.17
• 7.3
  CVE-2026-72658 Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… fixed in 8.19.20
• 7.2
  CVE-2025-68385 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers… fixed in 8.19.9
• 7.1
  CVE-2026-72675 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… fixed in 8.19.20
• 6.5
  CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) fixed in 8.19.22
• 6.5
  CVE-2026-78599 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (C… fixed in 8.19.18
• 6.5
  CVE-2026-78586 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could… fixed in 8.19.16
• 6.5
  CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… fixed in 8.19.21
• 6.5
  CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… fixed in 8.19.21
• 6.5
  CVE-2026-72652 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted r… fixed in 8.19.19
• 6.5
  CVE-2026-33465 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could… fixed in 8.19.17
• 6.5
  CVE-2026-72667 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… fixed in 8.19.20
• 6.5
  CVE-2026-72659 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… fixed in 8.19.20
• 6.5
  CVE-2026-72660 Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… fixed in 8.19.20
• 6.5
  CVE-2026-72663 Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… fixed in 8.19.20
• 6.5
  CVE-2026-72651 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… fixed in 8.19.20
• 6.5
  CVE-2026-49089 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… fixed in 8.19.20
• 6.5
  CVE-2026-63260 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of… fixed in 8.19.19
• 6.5
  CVE-2026-63261 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to… fixed in 8.19.19
• 6.5
  CVE-2026-56151 Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is… fixed in 8.19.17
• 6.5
  CVE-2026-49087 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted b… fixed in 8.19.15
• 6.5
  CVE-2026-49094 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request contain… fixed in 8.19.16
• 6.5
  CVE-2026-49095 Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent… fixed in 8.19.16
• 6.5
  CVE-2026-42399 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentia… fixed in 8.19.16
• 6.5
  CVE-2026-42400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request paylo… fixed in 8.19.16
• 6.5
  CVE-2026-33464 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a speciall… fixed in 8.19.16
• 6.5
  CVE-2026-26939 Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process s… fixed in 8.19.12
• 6.5
  CVE-2026-26940 Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-130). The vulnerability allow… fixed in 8.19.13
• 6.5
  CVE-2026-26937 Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) fixed in 8.19.11
• 6.5
  CVE-2026-0543 Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires… fixed in 8.19.0
• 6.5
  CVE-2026-0528 Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed pay… fixed in 8.19.10
• 6.5
  CVE-2026-0530 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted request. This causes the application to perform r… fixed in 8.19.10
• 6.5
  CVE-2026-0531 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker… fixed in 8.19.10
• 6.5
  CVE-2025-68389 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial… fixed in 8.19.9
• 6.5
  CVE-2024-52974 An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permi… fixed in 8.15.1
• 6.5
  CVE-2024-43708 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with… fixed in 8.15.0
• 6.5
  CVE-2024-52972 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read acce… fixed in 8.15.0
• 6.5
  CVE-2024-52973 An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read a… fixed in 8.14.2
• 6.5
  CVE-2024-37281 An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint. fixed in 8.14.0
• 6.5
  CVE-2024-23446 An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{s… fixed in 8.12.1
• 6.5
  CVE-2022-38778 A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process. fixed in 8.6.1
• 6.3
  CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126)… fixed in 8.19.17
• 6.1
  CVE-2025-68387 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browse… fixed in 8.19.9
• 6.1
  CVE-2024-23442 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. fixed in 8.14.0
• 6.1
  CVE-2022-38779 An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. fixed in 8.6.2
• 6.1
  CVE-2022-23713 A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser.
• 5.4
  CVE-2026-78598 Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An auth… fixed in 8.19.19
• 5.4
  CVE-2026-72673 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… fixed in 8.19.20
• 5.4
  CVE-2025-37732 Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package up… fixed in 8.19.8
• 5.3
  CVE-2026-33463 Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time… fixed in 8.19.16
• 5.3
  CVE-2022-23711 A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the he… fixed in 8.1.3
• 5.0
  CVE-2026-63142 Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administra… fixed in 8.19.19
• 4.9
  CVE-2026-26936 Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492). fixed in 8.19.11
• 4.9
  CVE-2024-23443 A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack. fixed in 8.14.0
• 4.6
  CVE-2026-33462 A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identi… fixed in 8.19.16
• 4.4
  CVE-2026-49088 Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensi… fixed in 8.18.9
• 4.3
  CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… fixed in 8.19.21
• 4.3
  CVE-2026-72671 A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… fixed in 8.19.20
• 4.3
  CVE-2026-72650 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… fixed in 8.19.20
• 4.3
  CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… fixed in 8.19.20
• 4.3
  CVE-2026-49096 Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… fixed in 8.19.20
• 4.3
  CVE-2026-63145 Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1… fixed in 8.19.19
• 4.3
  CVE-2026-33460 Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can ret… fixed in 8.19.14
• 4.3
  CVE-2025-68386 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not ha… fixed in 8.19.8
• 4.3
  CVE-2025-68422 Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HTTP request. This… fixed in 8.19.7
• 4.3
  CVE-2025-25012 URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL. fixed in 8.17.8
• 4.3
  CVE-2025-25016 Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation. fixed in 8.13.0
• 4.2
  CVE-2026-78581 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain… fixed in 8.16.3
• 4.1
  CVE-2026-42401 Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup whi… fixed in 8.19.16

Newer releases