What’s Vulnerable › Products
Kibana vulnerabilities
202 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 125 published in the last 12 months.
Check whether your Kibana version is affected
Exploited Kibana vulnerabilities
- CVE-2019-7609 — Kibana Arbitrary Code Execution
Latest Kibana vulnerabilities
- CVE-2026-102412 — Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure (CVSS 6.5)
- CVE-2026-102410 — Missing Authorization in Kibana Leading to Information Disclosure (CVSS 4.3)
- CVE-2026-102406 — Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception (CVSS 8.8)
- CVE-2026-94400 — Uncontrolled Resource Consumption in Kibana Leading to denial of service (CVSS 6.5)
- CVE-2026-78582 — Missing Authorization in Kibana Leading to Unauthorized Deletion of Data (CVSS 6.5)
- CVE-2026-72668 — Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation (CVSS 7.3)
- CVE-2026-72662 — Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data (CVSS 6.3)
- CVE-2026-82302 — Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification (CVSS 8.1)
- CVE-2026-82299 — Incorrect Authorization in Kibana Leading to Information Disclosure (CVSS 6.5)
- CVE-2026-82298 — Incorrect Authorization in Kibana Leading to Denial of Service (CVSS 4.3)
- CVE-2026-78596 — Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations (CVSS 4.3)
- CVE-2026-78595 — Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure (CVSS 4.3)
- CVE-2026-78593 — Improper Control of Generation of Code in Kibana Leading to Privilege Escalation (CVSS 4.3)
- CVE-2026-78583 — Incorrect Authorization in Kibana Leading to Privilege Escalation (CVSS 8.1)
- CVE-2026-82293 — Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption (CVSS 4.3)
- CVE-2026-78601 — Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure (CVSS 5.5)
- CVE-2026-78599 — Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources (CVSS 6.5)
- CVE-2026-78598 — Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data (CVSS 5.4)
- CVE-2026-78591 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion (CVSS 6.3)
- CVE-2026-78590 — Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources (CVSS 7.3)
- CVE-2026-78586 — Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5)
- CVE-2026-78584 — Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure (CVSS 4.3)
- CVE-2026-78608 — Missing Authorization in Kibana Leading to Information Disclosure (CVSS 6.5)
- CVE-2026-78606 — Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data (CVSS 4.2)
- CVE-2026-78603 — Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata (CVSS 4.3)