Is Kibana 8.19.19 affected?

Vulnerabilities affecting 8.19.19

• 8.8
  CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deploym… fixed in 8.19.22
• 8.1
  CVE-2026-78583 Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packa… fixed in 8.19.21
• 8.1
  CVE-2026-72665 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by… fixed in 8.19.20
• 7.7
  CVE-2026-72670 A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read se… fixed in 8.19.20
• 7.3
  CVE-2026-72658 Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially craf… fixed in 8.19.20
• 7.1
  CVE-2026-72675 Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its… fixed in 8.19.20
• 7.1
  CVE-2026-72632 Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the r… fixed in 8.19.20
• 7.1
  CVE-2026-72629 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result i… fixed in 8.19.20
• 7.1
  CVE-2026-72630 Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific in… fixed in 8.19.20
• 6.5
  CVE-2026-94400 Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) fixed in 8.19.22
• 6.5
  CVE-2026-78608 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function… fixed in 8.19.21
• 6.5
  CVE-2026-72654 Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding on… fixed in 8.19.21
• 6.5
  CVE-2026-72628 Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges cou… fixed in 8.19.21
• 6.5
  CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an i… fixed in 8.19.20
• 6.5
  CVE-2026-72667 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authentica… fixed in 8.19.20
• 6.5
  CVE-2026-72659 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Ki… fixed in 8.19.20
• 6.5
  CVE-2026-72660 Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only… fixed in 8.19.20
• 6.5
  CVE-2026-72663 Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSV… fixed in 8.19.20
• 6.5
  CVE-2026-72664 Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-… fixed in 8.19.20
• 6.5
  CVE-2026-72651 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the a… fixed in 8.19.20
• 6.5
  CVE-2026-49089 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting ope… fixed in 8.19.20
• 5.4
  CVE-2026-72673 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics priv… fixed in 8.19.20
• 4.3
  CVE-2026-78597 Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authentica… fixed in 8.19.21
• 4.3
  CVE-2026-72671 A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomal… fixed in 8.19.20
• 4.3
  CVE-2026-72650 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user… fixed in 8.19.20
• 4.3
  CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of… fixed in 8.19.20
• 4.3
  CVE-2026-49096 Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when… fixed in 8.19.20
• 4.2
  CVE-2026-78606 Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two… fixed in 8.19.21

Newer releases