CVE Vulnerability Catalog

Kibana has a resource allocation vulnerability (CWE-770) leading to denial of service via excessive allocation. A specially crafted request from an authenticated user with minimal privileges to a validation capability in the Observability log analysis feature causes unbounded concurrent work. This can exhaust memory and make Kibana unavailable until restart.

Kibana has an authorization bypass vulnerability through user-controlled key (CWE-639), allowing unauthorized query execution against Elastic Agents assigned to a space the user has no access to. A user authorized to run Osquery live queries in one space can have queries executed on hosts in another space, leading to information disclosure to the Osquery results data stream.

Kibana has a missing authorization vulnerability (CWE-862) allowing unauthorized execution of Elastic Defend response actions on managed hosts. A user with only detection rule authoring privileges can associate automated endpoint response actions with a rule, even without dedicated endpoint privileges. When the rule generates alerts, the actions are executed on matching hosts.

Kibana has an inefficient algorithmic complexity vulnerability (CWE-407) leading to denial of service via input data manipulation. A specially crafted, deeply nested expression submitted to a TSVB visualization is evaluated with worst-case cost growing disproportionately with input size. Because evaluation runs synchronously, a single request consumes the request-processing thread indefinitely, and Kibana stops responding until restart.

Kibana has a missing authorization vulnerability (CWE-862) leading to information disclosure. An internal data retrieval capability used by Elastic Defend response actions did not enforce Security Solution and endpoint privileges, and retrieved data with elevated internal permissions. An authenticated low-privileged user with no Security Solution, endpoint, or Elasticsearch privileges could read endpoint response action records and response content from managed hosts.

An uncaught exception in Kibana, resulting from improper input validation, can lead to denial of service. An authenticated user with low privileges can submit specially crafted data that causes an internal error and terminates the Kibana process. Kibana becomes unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user with low privileges can submit a specially crafted malformed payload to a visualization feature, causing uncontrolled memory growth. The Kibana process is terminated once memory is exhausted, and the service becomes unavailable until restart.

Authorization bypass through user-controlled key in Fleet Server can lead to information disclosure. The authorization decision for artifact downloads relied on a client-supplied value that was not validated against the server-side record of the agent's assignment. An authenticated party with valid agent credentials could retrieve a policy the agent is not assigned to.

Memory allocation with excessive size in ES|QL query processing of Elasticsearch can lead to denial of service. An authenticated user can submit a specially crafted query whose evaluation allocates unbounded heap memory, exhausting available heap on the receiving node and causing the node to become unavailable.

Improperly controlled modification of dynamically-determined object attributes in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data. An authenticated user without case editing privileges can alter case records they are only entitled to view, because the case management API does not enforce the same authorization as the user interface.

Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user authorized to manage maintenance windows can submit a specially crafted malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.

Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user with read-only privileges to the alerting feature can submit a specially crafted malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.

Authorization bypass through user-controlled key in Kibana can lead to information disclosure. An authenticated user authorized to read alerting rules in a single Kibana space could retrieve alerting rule execution telemetry that belongs to spaces the user is not authorized to access. The disclosed telemetry includes rule identifiers, rule names, space identifiers, execution outcomes, timestamps, and execution counters.

Cleartext storage of sensitive information in an environment variable in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for other credentials. Any principal able to read workload specifications in the affected namespace can read a live Elasticsearch credential, even when Kubernetes RBAC does not grant that principal access to Secrets.

Uncontrolled recursion in Elasticsearch can lead to denial of service. An authenticated user with read-only privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

A vulnerability in Elasticsearch allows an authenticated user with read-only privileges on a single index to submit one small, specially crafted search request that causes excessive memory allocation, exhausting the JVM heap and terminating the affected node.

The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages and accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user with Kubernetes permissions limited to their own namespace can write that annotation, trigger a reconcile, and cause the operator to use its cluster-wide secret permissions to copy the contents of a secret from any other namespace into a secret the user can read.

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user with read-only privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user with low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.