Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-102407Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
- CVE-2026-102406Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
- CVE-2026-102404Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-94408Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94397Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94396Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94400Uncontrolled Resource Consumption in Kibana Leading to denial of service
- CVE-2026-94399Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-94398Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
- CVE-2026-82300Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-82294Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-78582Missing Authorization in Kibana Leading to Unauthorized Deletion of Data
- CVE-2026-72662Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data
- CVE-2026-72668Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation
- CVE-2026-82302Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification
- CVE-2026-82299Incorrect Authorization in Kibana Leading to Information Disclosure
- CVE-2026-82298Incorrect Authorization in Kibana Leading to Denial of Service
- CVE-2026-78596Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations
- CVE-2026-78595Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure
- CVE-2026-78593Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
- CVE-2026-78583Incorrect Authorization in Kibana Leading to Privilege Escalation
- CVE-2026-82293Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption
- CVE-2026-78588Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service
- CVE-2026-78587Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
- CVE-2026-78586Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-78584Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
- CVE-2026-78591Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion
- CVE-2026-78590Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
- CVE-2026-78599Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
- CVE-2026-78598Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data