Elastic vulnerabilities
396 CVEs and advisories name Elastic as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-56145Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-56144Incorrect Authorization in Elasticsearch Leading to Information Disclosure
- CVE-2026-42397Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-49092Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure
- CVE-2026-49091Improper Output Neutralization for Logs in Kibana Leading to Log Injection
- CVE-2026-49090Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
- CVE-2026-49088Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure
- CVE-2026-49087Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
- CVE-2026-56152Incorrect Authorization in Kibana Leading to Information Disclosure
- CVE-2026-56151Improper Input Validation in Kibana Leading to Denial of Service
- CVE-2026-56150Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
- CVE-2026-56149Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-56148Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-49093Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
- CVE-2026-49094Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-49095Improper Input Validation in Kibana Fleet Leading to Privilege Escalation
- CVE-2026-42398Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
- CVE-2026-42399Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-42400Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-42401Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection
- CVE-2026-33463Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access
- CVE-2026-33464Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-33462Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts
- CVE-2026-33467Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass
- CVE-2026-33466Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
- CVE-2026-33458Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure
- CVE-2026-33459Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
- CVE-2026-33460Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
- CVE-2026-33461Incorrect Authorization in Kibana Fleet Leading to Information Disclosure
- CVE-2026-4498Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope