Kibana (Product): news timeline & CVEs

Elastic security advisory (AV26-1021)

Canada's Cyber Centre warns Elasticsearch and Kibana users to install Elastic updates ESA-2026-185 and ESA-2026-187.

The Canadian Centre for Cyber Security published advisory AV26-1021 on October 8, 2026, stating that as of October 6 Elasticsearch and Kibana were affected by vulnerabilities. Elasticsearch versions prior to or equal to 8.19.23, 9.4.8, and 9.5.5, and Kibana versions prior to or equal to 8.19.22, 9.4.7, and 9.5.4, are listed. Elastic’s related announcements are ESA-2026-185 for Elasticsearch and ESA-2026-187 for Kibana. The centre urges administrators to review the notices and apply updates; the advisory does not report exploitation.

Canadian Centre for Cyber SecurityOct 8, 15:21 UTC · 9h agoAdvisory 3 sources

Elastic Fixes 14 Security Flaws Including One That Lets Attackers Intercept Other Users’ Data

Elastic patched 14 flaws, including a CVSS 8.8 Kibana bug letting Fleet users intercept other tenants' data.

Elastic published 14 advisories for Elasticsearch, Kibana, and Elastic Agent/Endpoint. The most serious, CVE-2026-102406 (CVSS 8.8), lets a delegated Fleet user with custom-package install rights claim another tenant's data stream identifier and apply attacker-controlled index and ingest-pipeline settings, intercepting or modifying newly ingested data. Affected Kibana ranges are 8.14.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3, fixed in 8.19.22, 9.4.7, and 9.5.4. Other fixes cover CVE-2026-103009 (CVSS 7.1) cross-cluster search authorization bypass, two CVSS 6.5 Elasticsearch denial-of-service flaws, and Elastic Endpoint CVE-2026-102413 (CVSS 6.2).

Cyber Security Newsupdated Oct 8, 15:21 UTC · 9h agofirst Oct 8, 03:41 UTC · 20h agoVulnerability 3 sources CVE-2026-102406 CVE-2026-103009 CVE-2026-103008+2 CVEs1

Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception

Elastic patched 14 flaws, including a Kibana bypass that can intercept another tenant's data.

Elastic published 14 advisories for Elasticsearch, Kibana, and Elastic Agent/Endpoint. CVE-2026-102406 (CVSS 8.8) is a Kibana authorization bypass that lets a user with Fleet package-management rights claim another tenant's data stream and redirect ingested data; Elastic says tenant means users sharing one deployment, not separate Elastic Cloud customers. Affected Kibana ranges are 8.14.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3, fixed in 8.19.22, 9.4.7, and 9.5.4. Other fixes cover Elasticsearch cross-cluster data access (CVE-2026-103009), two denial-of-service bugs, and an Elastic Endpoint crash on Windows.

GBHackersupdated Oct 8, 15:21 UTC · 9h agofirst Oct 7, 10:36 UTC · 1d agoVulnerability 3 sources CVE-2026-102406 CVE-2026-103009 CVE-2026-103008+2 CVEs

SOCRadar Alarms in Elastic | Investigate Threats Faster

SOCRadar says analysts can investigate its alarms inside Elastic and Kibana instead of a separate console.

SOCRadar announced that its alarms can be investigated from Elastic, where many SOC teams already keep detections, logs, cases, and Kibana dashboards. The integration is meant to surface external findings such as impersonating domains, leaked credentials, and newly exposed assets without leaving the Elastic console. The post is product marketing rather than a vulnerability or incident report.

SOCRadarOct 6, 15:10 UTC · 2d agoIndustry

No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current

Elastic InfoSec uses a 68-line workflow to keep Linux endpoint and AI-agent config current without MDM.

Elastic Security Labs describes a 68-line Elastic Workflow that keeps Linux workstation configuration current without MDM. Every six hours it lists endpoints running Elastic Agent and Elastic Defend, then queues one response action only if that script is not already pending. The production use case pushes managed Cursor and Codex settings, including legacy OpenTelemetry defaults in managed_config.toml. The pattern was validated on Elastic Stack 9.5.1 and requires Workflows, available as GA since Elastic 9.4.

Elastic Security LabsSep 29, 00:00 UTC · 10d agoTools

Kibana

Timeline5 articles

Related CVEsby mentions

Appears with

Elastic security advisory (AV26-1021)

Elastic Fixes 14 Security Flaws Including One That Lets Attackers Intercept Other Users’ Data

Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception

SOCRadar Alarms in Elastic | Investigate Threats Faster

No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current