{"schema_version":1,"title":"Elastic Kibana vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 84 vulnerabilities in Elastic Kibana: 4 in the last 7 days and 66 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-94400, was published on 26 September 2026.","url":"https://junglewise.ai/threats/technologies/kibana","json_url":"https://junglewise.ai/threats/technologies/kibana.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/kibana","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":18,"all_time":84,"critical":1,"exploited":1,"last_7_days":4,"last_30_days":35,"last_90_days":66,"last_365_days":82},"latest":[{"cve":"CVE-2026-94400","cvss":6.5,"slug":"cve-2026-94400-uncontrolled-resource-consumption-cwe-400-in-kibana-can-lead","title":"Elastic Kibana denial of service via resource consumption","severity":"medium","exploited":false,"published_at":"2026-09-26T21:16:56.513+00:00","url":"https://junglewise.ai/threats/cve-2026-94400-uncontrolled-resource-consumption-cwe-400-in-kibana-can-lead"},{"cve":"CVE-2026-78582","cvss":6.5,"slug":"cve-2026-78582-missing-authorization-cwe-862-in-kibana-can-lead-to-unauthorized","title":"Kibana missing authorization in Synthetics monitors deletion","severity":"medium","exploited":false,"published_at":"2026-09-26T21:16:55.663+00:00","url":"https://junglewise.ai/threats/cve-2026-78582-missing-authorization-cwe-862-in-kibana-can-lead-to-unauthorized"},{"cve":"CVE-2026-72668","cvss":7.3,"slug":"cve-2026-72668-unintended-proxy-or-intermediary-confused-deputy-cwe-441-in","title":"Elastic Kibana privilege escalation in Agent Builder","severity":"high","exploited":false,"published_at":"2026-09-26T21:16:55.54+00:00","url":"https://junglewise.ai/threats/cve-2026-72668-unintended-proxy-or-intermediary-confused-deputy-cwe-441-in"},{"cve":"CVE-2026-72662","cvss":6.3,"slug":"cve-2026-72662-authorization-bypass-through-user-controlled-key-cwe-639-in","title":"Elastic Kibana authorization bypass in Timeline feature","severity":"medium","exploited":false,"published_at":"2026-09-26T21:16:55.41+00:00","url":"https://junglewise.ai/threats/cve-2026-72662-authorization-bypass-through-user-controlled-key-cwe-639-in"},{"cve":"CVE-2026-75897","cvss":7.5,"slug":"cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in","title":"OpenSearch Dashboards uncontrolled resource consumption in capabilities route","severity":"high","exploited":false,"published_at":"2026-09-09T21:30:11+00:00","url":"https://junglewise.ai/threats/cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in"},{"cve":"CVE-2026-82302","cvss":8.1,"epss":0.0039,"slug":"cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control","title":"Elastic Kibana authorization bypass in access control","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:29.827+00:00","url":"https://junglewise.ai/threats/cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control"},{"cve":"CVE-2026-82299","cvss":6.5,"epss":0.0038,"slug":"cve-2026-82299-elastic-kibana-authorization-bypass-leading-to-information","title":"Elastic Kibana authorization bypass leading to information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:29.707+00:00","url":"https://junglewise.ai/threats/cve-2026-82299-elastic-kibana-authorization-bypass-leading-to-information"},{"cve":"CVE-2026-82298","cvss":4.3,"epss":0.0033,"slug":"cve-2026-82298-elastic-kibana-authorization-bypass-in-access-control","title":"Elastic Kibana authorization bypass in access control","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:29.587+00:00","url":"https://junglewise.ai/threats/cve-2026-82298-elastic-kibana-authorization-bypass-in-access-control"},{"cve":"CVE-2026-78596","cvss":4.3,"epss":0.0027,"slug":"cve-2026-78596-elastic-kibana-authorization-bypass-in-entity-analytics-migration","title":"Elastic Kibana authorization bypass in Entity Analytics migration","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:28.993+00:00","url":"https://junglewise.ai/threats/cve-2026-78596-elastic-kibana-authorization-bypass-in-entity-analytics-migration"},{"cve":"CVE-2026-78595","cvss":4.3,"epss":0.0028,"slug":"cve-2026-78595-elastic-kibana-missing-authorization-in-fleet-cross-space-data","title":"Elastic Kibana missing authorization in Fleet cross-space data disclosure","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:28.85+00:00","url":"https://junglewise.ai/threats/cve-2026-78595-elastic-kibana-missing-authorization-in-fleet-cross-space-data"},{"cve":"CVE-2026-78593","cvss":4.3,"epss":0.0029,"slug":"cve-2026-78593-elastic-kibana-code-injection-in-cribl-integration","title":"Elastic Kibana code injection in Cribl integration","severity":"medium","exploited":false,"published_at":"2026-09-03T19:17:28.687+00:00","url":"https://junglewise.ai/threats/cve-2026-78593-elastic-kibana-code-injection-in-cribl-integration"},{"cve":"CVE-2026-78583","cvss":8.1,"epss":0.0039,"slug":"cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration","title":"Elastic Kibana privilege escalation via Fleet integration validation bypass","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:28.55+00:00","url":"https://junglewise.ai/threats/cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration"},{"cve":"CVE-2026-82293","cvss":4.3,"epss":0.0037,"slug":"cve-2026-82293-elastic-kibana-authorization-bypass-in-machine-learning","title":"Elastic Kibana authorization bypass in machine learning","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:43.157+00:00","url":"https://junglewise.ai/threats/cve-2026-82293-elastic-kibana-authorization-bypass-in-machine-learning"},{"cve":"CVE-2026-78601","cvss":5.5,"epss":0.0035,"slug":"cve-2026-78601-elastic-kibana-missing-authorization-in-entity-store","title":"Elastic Kibana missing authorization in Entity Store configuration","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:41.277+00:00","url":"https://junglewise.ai/threats/cve-2026-78601-elastic-kibana-missing-authorization-in-entity-store"},{"cve":"CVE-2026-78599","cvss":6.5,"epss":0.0048,"slug":"cve-2026-78599-elastic-kibana-path-traversal-in-fleet-leading-to-unauthorized","title":"Elastic Kibana path traversal in Fleet leading to unauthorized deletion","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:41.003+00:00","url":"https://junglewise.ai/threats/cve-2026-78599-elastic-kibana-path-traversal-in-fleet-leading-to-unauthorized"},{"cve":"CVE-2026-78598","cvss":5.4,"epss":0.0024,"slug":"cve-2026-78598-elastic-kibana-machine-learning-privilege-escalation-via-space","title":"Elastic Kibana machine learning privilege escalation via space boundary bypass","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.863+00:00","url":"https://junglewise.ai/threats/cve-2026-78598-elastic-kibana-machine-learning-privilege-escalation-via-space"},{"cve":"CVE-2026-78591","cvss":6.3,"epss":0.0036,"slug":"cve-2026-78591-elastic-kibana-path-traversal-in-fleet-feature","title":"Elastic Kibana path traversal in Fleet feature","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.57+00:00","url":"https://junglewise.ai/threats/cve-2026-78591-elastic-kibana-path-traversal-in-fleet-feature"},{"cve":"CVE-2026-78590","cvss":7.3,"epss":0.0041,"slug":"cve-2026-78590-elastic-kibana-path-traversal-in-fleet-feature","title":"Elastic Kibana path traversal in Fleet feature","severity":"high","exploited":false,"published_at":"2026-09-02T15:17:40.433+00:00","url":"https://junglewise.ai/threats/cve-2026-78590-elastic-kibana-path-traversal-in-fleet-feature"},{"cve":"CVE-2026-78586","cvss":6.5,"epss":0.0047,"slug":"cve-2026-78586-elastic-kibana-denial-of-service-via-unbounded-memory-allocation","title":"Elastic Kibana denial of service via unbounded memory allocation","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:40.063+00:00","url":"https://junglewise.ai/threats/cve-2026-78586-elastic-kibana-denial-of-service-via-unbounded-memory-allocation"},{"cve":"CVE-2026-78584","cvss":4.3,"epss":0.0031,"slug":"cve-2026-78584-elastic-kibana-information-disclosure-in-osquery-feature","title":"Elastic Kibana information disclosure in Osquery feature","severity":"medium","exploited":false,"published_at":"2026-09-02T15:17:39.943+00:00","url":"https://junglewise.ai/threats/cve-2026-78584-elastic-kibana-information-disclosure-in-osquery-feature"},{"cve":"CVE-2026-78608","cvss":6.5,"epss":0.0038,"slug":"cve-2026-78608-elastic-kibana-missing-authorization-in-apm-integration","title":"Elastic Kibana missing authorization in APM integration","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:24.16+00:00","url":"https://junglewise.ai/threats/cve-2026-78608-elastic-kibana-missing-authorization-in-apm-integration"},{"cve":"CVE-2026-78606","cvss":4.2,"epss":0.0023,"slug":"cve-2026-78606-elastic-kibana-incorrect-authorization-in-ai-assistant","title":"Elastic Kibana incorrect authorization in AI Assistant","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:23.887+00:00","url":"https://junglewise.ai/threats/cve-2026-78606-elastic-kibana-incorrect-authorization-in-ai-assistant"},{"cve":"CVE-2026-78603","cvss":4.3,"epss":0.0029,"slug":"cve-2026-78603-elastic-kibana-missing-authorization-in-space-access-controls","title":"Elastic Kibana missing authorization in space access controls","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:23.637+00:00","url":"https://junglewise.ai/threats/cve-2026-78603-elastic-kibana-missing-authorization-in-space-access-controls"},{"cve":"CVE-2026-78597","cvss":4.3,"epss":0.0029,"slug":"cve-2026-78597-elastic-kibana-missing-authorization-in-entity-store","title":"Elastic Kibana missing authorization in Entity Store","severity":"medium","exploited":false,"published_at":"2026-09-01T20:17:23.51+00:00","url":"https://junglewise.ai/threats/cve-2026-78597-elastic-kibana-missing-authorization-in-entity-store"},{"cve":"CVE-2026-78592","cvss":7.3,"epss":0.0041,"slug":"cve-2026-78592-elastic-kibana-path-traversal-in-tag-management","title":"Elastic Kibana path traversal in tag management","severity":"high","exploited":false,"published_at":"2026-09-01T20:17:23.387+00:00","url":"https://junglewise.ai/threats/cve-2026-78592-elastic-kibana-path-traversal-in-tag-management"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":30},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":4}],"related":[{"name":"Elasticsearch","slug":"elasticsearch","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/elasticsearch"},{"name":"Elastic Cloud on Kubernetes","slug":"cloud-on-kubernetes","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cloud-on-kubernetes"},{"name":"Elastic Fleet Server","slug":"fleet-server","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/fleet-server"}],"technology":{"hub":true,"name":"Elastic Kibana","slug":"kibana","vendor":{"name":"Elastic","slug":"elastic","url":"https://junglewise.ai/threats/vendors/elastic"},"aliases":[],"category":"web-server","description":"Web UI and visualization platform for Elasticsearch clusters.","url":"https://junglewise.ai/threats/technologies/kibana"},"most_severe":[{"cve":"CVE-2019-7609","cvss":10,"slug":"cve-2019-7609-kibana-arbitrary-code-execution","title":"Kibana Arbitrary Code Execution","severity":"critical","exploited":true,"published_at":"2022-01-10T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2019-7609-kibana-arbitrary-code-execution"},{"cve":"CVE-2026-0532","cvss":8.6,"epss":0.0031,"slug":"cve-2026-0532-elastic-kibana-ssrf-and-arbitrary-file-disclosure-in-google-gemini","title":"Elastic Kibana SSRF and arbitrary file disclosure in Google Gemini connector","severity":"high","exploited":false,"published_at":"2026-01-14T11:15:50.51+00:00","url":"https://junglewise.ai/threats/cve-2026-0532-elastic-kibana-ssrf-and-arbitrary-file-disclosure-in-google-gemini"},{"cve":"CVE-2026-63137","cvss":8.3,"epss":0.005,"slug":"cve-2026-63137-elastic-kibana-privilege-escalation-in-workflows-access-control","title":"Elastic Kibana privilege escalation in Workflows access control","severity":"high","exploited":false,"published_at":"2026-09-01T20:17:15.117+00:00","url":"https://junglewise.ai/threats/cve-2026-63137-elastic-kibana-privilege-escalation-in-workflows-access-control"},{"cve":"CVE-2026-82302","cvss":8.1,"epss":0.0039,"slug":"cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control","title":"Elastic Kibana authorization bypass in access control","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:29.827+00:00","url":"https://junglewise.ai/threats/cve-2026-82302-elastic-kibana-authorization-bypass-in-access-control"},{"cve":"CVE-2026-78583","cvss":8.1,"epss":0.0039,"slug":"cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration","title":"Elastic Kibana privilege escalation via Fleet integration validation bypass","severity":"high","exploited":false,"published_at":"2026-09-03T19:17:28.55+00:00","url":"https://junglewise.ai/threats/cve-2026-78583-elastic-kibana-privilege-escalation-via-fleet-integration"},{"cve":"CVE-2026-49091","cvss":8,"slug":"cve-2026-49091-elastic-kibana-log-injection-in-log-output","title":"Elastic Kibana log injection in log output","severity":"high","exploited":false,"published_at":"2026-07-01T18:16:34.04+00:00","url":"https://junglewise.ai/threats/cve-2026-49091-elastic-kibana-log-injection-in-log-output"},{"cve":"CVE-2026-4498","cvss":7.7,"epss":0.003,"slug":"cve-2026-4498-elastic-kibana-privilege-abuse-in-fleet-plugin-debug-routes","title":"Elastic Kibana privilege abuse in Fleet plugin debug routes","severity":"high","exploited":false,"published_at":"2026-04-08T17:21:24.3+00:00","url":"https://junglewise.ai/threats/cve-2026-4498-elastic-kibana-privilege-abuse-in-fleet-plugin-debug-routes"},{"cve":"CVE-2026-33461","cvss":7.7,"epss":0.0028,"slug":"cve-2026-33461-elastic-kibana-incorrect-authorization-in-fleet-component","title":"Elastic Kibana incorrect authorization in Fleet component","severity":"high","exploited":false,"published_at":"2026-04-08T17:21:19.153+00:00","url":"https://junglewise.ai/threats/cve-2026-33461-elastic-kibana-incorrect-authorization-in-fleet-component"},{"cve":"CVE-2026-42398","cvss":7.7,"slug":"cve-2026-42398-elastic-kibana-ssrf-allowlist-bypass-in-webhook-connector","title":"Elastic Kibana SSRF allowlist bypass in Webhook connector","severity":"high","exploited":false,"published_at":"2026-05-28T21:16:30.18+00:00","url":"https://junglewise.ai/threats/cve-2026-42398-elastic-kibana-ssrf-allowlist-bypass-in-webhook-connector"},{"cve":"CVE-2026-75897","cvss":7.5,"slug":"cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in","title":"OpenSearch Dashboards uncontrolled resource consumption in capabilities route","severity":"high","exploited":false,"published_at":"2026-09-09T21:30:11+00:00","url":"https://junglewise.ai/threats/cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}