E

Elastic Security Announcements

https://discuss.elastic.co/c/announcements/security-announcements/31.rss (RSS订阅地址)

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)

<p><strong>Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys</strong></p> <p><strong>Description:</strong><br> Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.1.0 up to and including 9.4.4</li> <li>Version 9.5.0</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations are affected.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 9.4.5 and 9.5.1.<br> <strong>For Users that Cannot Upgrade:</strong></p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong><br> Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N<br> <strong>CVE ID:</strong> CVE-2026-72631<br> <strong>Problem Type:</strong> CWE-269 - Improper Privilege Management<br> <strong>Impact:</strong> CAPEC-233 - Privilege Escalation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-128/389539">Read full topic</a></p>

8/13/2026
Read more

Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-124)

<p><strong>Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents</strong></p> <p>Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.4.0 up to and including 9.4.4</li> <li>Version 9.5.0</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations that use multiple authentication realms where the user has control over their selected username.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in Kibana versions 9.4.5 and 9.5.1.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: High ( 7.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N<br> <strong>CVE ID:</strong> CVE-2026-72643<br> <strong>Problem Type:</strong> CWE-863 - Incorrect Authorization</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-124/389538">Read full topic</a></p>

8/13/2026
Read more

Kibana 9.4.5 Security Update (ESA-2026-97)

<p><strong>Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts</strong></p> <p>Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.1.0 up to and including 9.4.4</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations are affected.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 9.4.5.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong><br> No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.8 ) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N<br> <strong>CVE ID:</strong> CVE-2026-72666<br> <strong>Problem Type:</strong> CWE-639 - Authorization Bypass Through User-Controlled Key<br> <strong>Impact:</strong> CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-97/389537">Read full topic</a></p>

8/13/2026
Read more

Kibana 9.4.5 Security Update (ESA-2026-89)

<p><strong>Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data</strong></p> <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.1.0 up to and including 9.4.4</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong></p> <blockquote> <ul> <li>All configurations are affected.</li> </ul> </blockquote> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 9.4.5.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong><br> No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: High ( 7.7 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N<br> <strong>CVE ID:</strong> CVE-2026-72672<br> <strong>Problem Type:</strong> CWE-863 - Incorrect Authorization</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-89/389536">Read full topic</a></p>

8/13/2026
Read more

Kibana 9.4.5 Security Update (ESA-2026-82)

<p><strong>Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification</strong></p> <p>Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user's conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.2.0 up to and including 9.4.4</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong></p> <blockquote> <ul> <li>Only conversations created through the agent-to-agent interface are affected, and the attacker must know or already share the identifier value used to create the target conversation</li> </ul> </blockquote> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 9.4.5.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <blockquote> <ul> <li>Disable Agent Builder globally by setting xpack.agentBuilder.enabled: false in kibana.yml and restarting Kibana. This fully removes exposure but also removes all Agent Builder functionality.</li> <li>Disable the Agent Builder feature in every Kibana space through Spaces management. This blocks the affected API as well as the user interface and does not require a restart, but must be applied to all spaces to be effective.</li> </ul> </blockquote> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N<br> <strong>CVE ID:</strong> CVE-2026-72680<br> <strong>Problem Type:</strong> CWE-639 - Authorization Bypass Through User-Controlled Key</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-4-5-security-update-esa-2026-82/389535">Read full topic</a></p>

8/13/2026
Read more

Kibana 9.4.4 Security Update (ESA-2026-83)

<p><strong>Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure</strong></p> <p>Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.4.0 up to and including 9.4.3</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong></p> <blockquote> <ul> <li>All configurations are affected.</li> </ul> </blockquote> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in version 9.4.4.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <blockquote> <ul> <li>There are no workarounds for this vulnerability.</li> </ul> </blockquote> <blockquote></blockquote> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong></p> <p>Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N<br> <strong>CVE ID:</strong> CVE-2026-72681<br> <strong>Problem Type:</strong> CWE-862 - Missing Authorization</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534">Read full topic</a></p>

8/13/2026
Read more

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-91)

<p><strong>Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service</strong></p> <p><strong>Description:</strong><br> Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 9.3.0 up to and including 9.3.7</li> <li>All versions from 9.4.0 up to and including 9.4.3</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations are affected.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 9.3.8 and 9.4.4.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong><br> No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong><br> Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H<br> <strong>CVE ID:</strong> CVE-2026-72674<br> <strong>Problem Type:</strong> CWE-770 - Allocation of Resources Without Limits or Throttling<br> <strong>Impact:</strong> CAPEC-130 - Excessive Allocation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-91/389533">Read full topic</a></p>

8/13/2026
Read more

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-129)

<p><strong>Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys</strong></p> <p><strong>Description:</strong><br> Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrolled Elastic Agent from the responses of its agent listing capability, but that capability accepted caller-supplied filter expressions over the stored field that holds the value, and evaluated them with Kibana's own internal Elasticsearch privileges rather than the caller's. Because the number of matching agents is reported back to the caller, the difference between a matching and a non-matching filter formed a side channel from which the full API key value could be reconstructed one character at a time with a short sequence of requests.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 8.19.0 up to and including 8.19.19</li> <li>All versions from 9.0.0 up to and including 9.4.4</li> <li>Version 9.5.0</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations are affected.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 8.19.20, 9.4.5, and 9.5.1.</p> <p>Fleet no longer accepts caller-supplied filter expressions over fields that hold API key material, so the agent listing result count no longer reveals anything about those values.</p> <p><strong>For Users that Cannot Upgrade:</strong></p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong><br> Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: High ( 7.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N<br> <strong>CVE ID:</strong> CVE-2026-72632<br> <strong>Problem Type:</strong> CWE-203 - Observable Discrepancy<br> <strong>Impact:</strong> CAPEC-116 - Excavation</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-129/389532">Read full topic</a></p>

8/13/2026
Read more

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-127)

<p><strong>Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation</strong></p> <p><strong>Description:</strong><br> Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>8.x: All versions from 8.19.0 up to and including 8.19.19</li> <li>All versions from 9.0.0 up to and including 9.4.4</li> <li>Version 9.5.0</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations are affected.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 8.19.20, 9.4.5, and 9.5.1.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong><br> Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: High ( 7.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N<br> <strong>CVE ID:</strong> CVE-2026-72630<br> <strong>Problem Type:</strong> CWE-863 - Incorrect Authorization<br> <strong>Impact:</strong> CAPEC-122 - Privilege Abuse</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-127/389531">Read full topic</a></p>

8/13/2026
Read more

Kibana 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-126)

<p><strong>Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models</strong></p> <p><strong>Description:</strong><br> Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). The result is disclosure of inference output from a trained model in a different space that the user is not authorized to list, read, or use, which exposes the behavior of a model. The same pattern also reached the deployment stop and deployment update operations, allowing an active trained model deployment in another space to be stopped or to have its allocated resources altered.</p> <p><strong>Affected Versions:</strong></p> <blockquote> <ul> <li>All versions from 8.19.0 up to and including 8.19.19</li> <li>All versions from 9.0.0 up to and including 9.4.4</li> <li>Version 9.5.0</li> </ul> </blockquote> <p><strong>Affected Configurations:</strong><br> All configurations are affected.</p> <p><strong>Solutions and Mitigations:</strong></p> <p>The issue is resolved in versions 8.19.20, 9.4.5 and 9.5.1.</p> <p><strong>For Users that Cannot Upgrade:</strong><br> There are no workarounds for this vulnerability.</p> <p><strong>Indicators of Compromise (IOC)</strong></p> <p>No specific indicators of compromise have been identified for this vulnerability.</p> <p><strong>Elastic Cloud Serverless</strong><br> Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.</p> <p><strong>Severity:</strong> CVSSv3.1: High ( 7.1 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L<br> <strong>CVE ID:</strong> CVE-2026-72629<br> <strong>Problem Type:</strong> CWE-639 - Authorization Bypass Through User-Controlled Key<br> <strong>Impact:</strong> CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs</p> <p><small>1 post - 1 participant</small></p> <p><a href="https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-9-5-1-security-update-esa-2026-126/389530">Read full topic</a></p>

8/13/2026
Read more

Recommended Feeds

Chen's Blog

Chen's Blog，分享安全领域的所思、所想、所学。

空鸣深语

空鸣深语

游研社

无论你是游戏死忠，还是轻度的休闲玩家，在这里都能找到感兴趣的东西。

人民网 要闻快讯

要闻快讯

小众软件

分享免费、小巧、实用、有趣、绿色的软件