Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-72631Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys
- CVE-2026-72630Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation
- CVE-2026-72629Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models
- CVE-2026-72643Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents
- CVE-2026-72642Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
- CVE-2026-72640Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure
- CVE-2026-72639Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service
- CVE-2026-72638Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72647Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72645Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-72648Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure
- CVE-2026-72657Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
- CVE-2026-72656Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- CVE-2026-72655Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification
- CVE-2026-72653Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72651Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72650Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
- CVE-2026-72663Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
- CVE-2026-72661Missing Authorization in Kibana Leading to Information Disclosure
- CVE-2026-72660Uncaught Exception in Kibana Leading to Denial of Service
- CVE-2026-72659Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72658Cross-Site Request Forgery in Kibana Leading to Privilege Escalation
- CVE-2026-72667Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-72666Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts
- CVE-2026-72665Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions
- CVE-2026-72664Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions
- CVE-2026-72677Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
- CVE-2026-72676Improper Control of Generation of Code in Fleet Server Leading to Code Injection
- CVE-2026-72675Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification
- CVE-2026-72674Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service