Elastic Kibana: 25 Coordinated Vulnerabilities Expose Authorization and DoS Risks
Key findings • 25 Kibana vulnerabilities disclosed on August 13, 2026, ranging from Medium to High severity. • Multiple CVEs involve authorization bypass and missing authorization checks, ena…
Key findings
- 25 Kibana vulnerabilities disclosed on August 13, 2026, ranging from Medium to High severity.
- Multiple CVEs involve authorization bypass and missing authorization checks, enabling unauthorized data access and modification.
- Several vulnerabilities are related to resource allocation issues (CWE-770), leading to denial-of-service conditions.
- Flaws affect various Kibana components including Fleet, Machine Learning, Elastic Security, and Observability features.
- Elastic has released patches; users are urged to update Kibana to the latest versions.
On August 13, 2026, Elastic disclosed a significant batch of 25 vulnerabilities affecting its observability and security platform, Kibana. The vulnerabilities, all disclosed on the same day, span a range of severity levels, with several rated as High. These flaws primarily revolve around authorization, resource allocation, and input validation issues, potentially allowing for unauthorized data access, modification, deletion, and denial-of-service conditions.
Several vulnerabilities center on authorization bypass and missing authorization checks. CVE-2026-72675 and CVE-2026-72665 highlight how Kibana's Machine Learning and Elastic Security capabilities, respectively, operate with elevated internal permissions and fail to adequately enforce per-request space filters or user privileges, leading to cross-space information disclosure and unauthorized data modification or response actions. Similarly, CVE-2026-72673 and CVE-2026-72664 describe scenarios where Synthetics private locations and Elastic Defend response actions can be improperly accessed or modified due to insufficient access controls. CVE-2026-72670 details how a lower-privileged user can read sensitive Fleet proxy configurations, potentially exposing credentials. CVE-2026-72669 points to an Observability Onboarding flow state not being bound to the user who created it, allowing authenticated users with read access to discover and view other users' flows. CVE-2026-72661 and CVE-2026-72650 also involve missing authorization in data retrieval and alerting rule telemetry, respectively, leading to information disclosure. CVE-2026-72629 specifically details an authorization bypass allowing unauthorized access to inference output from trained models in different spaces. CVE-2026-72643 indicates an issue with how Kibana determines agent ownership, potentially leading to discrepancies and information disclosure. CVE-2026-72632 describes an observable discrepancy in Kibana Fleet where API key values could be disclosed through filter expressions.
A notable theme among the vulnerabilities is the allocation of resources without limits or throttling (CWE-770), leading to denial-of-service conditions. CVE-2026-72674, CVE-2026-72667, CVE-2026-72659, and CVE-2026-72653 describe how specially crafted inputs to features like the Kibana Playground for RAG, Observability log analysis, visualization payloads, and maintenance window management can cause excessive resource consumption. CVE-2026-72663 points to inefficient algorithmic complexity in TSVB visualizations, also leading to denial of service.
Other vulnerabilities include a relative path traversal flaw (CVE-2026-72677) in Kibana Fleet that could allow unauthorized deletion of resources. CVE-2026-72658 details a Cross-Site Request Forgery (CSRF) vulnerability that could lead to privilege escalation through specially crafted Vega visualizations. CVE-2026-72655 describes an improperly controlled modification of object attributes in Elastic Security's case management, enabling unauthorized modification of case data. Uncaught exceptions due to improper input validation are present in CVE-2026-72660 and CVE-2026-49096, both leading to denial of service through crafted data or malformed case comments. CVE-2026-72672 highlights a security capability that queries Elastic Defend event data with internal accounts instead of user accounts, bypassing feature privileges. CVE-2026-72666 involves an authorization bypass allowing unauthorized query execution against Elastic Agents. CVE-2026-72651 also involves authorization bypass related to alerting rules. CVE-2026-72671 describes a Kibana Machine Learning capability that removes saved objects but only verifies privileges for anomaly detection jobs, not trained models.
Elastic has addressed these vulnerabilities in recent releases. Users are strongly advised to update to the latest versions of Kibana to mitigate these risks. The broad nature of these vulnerabilities underscores the importance of regular security patching and diligent access control management within Elastic environments.
This coordinated disclosure of 25 vulnerabilities highlights potential weaknesses across various Kibana components, from core authorization mechanisms to specific feature implementations. The concentration of high-severity flaws, particularly those related to authorization bypass and resource exhaustion, presents a significant risk to organizations utilizing the Elastic Stack. Prompt patching and a thorough review of security configurations are essential to protect against potential exploitation.