Elastic vulnerabilities
We track 86 vulnerabilities in Elastic products across 23 products. 86 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 3, 2026.
Latest Elastic vulnerabilities
- 7.7 High severity
Kibana: Execution with Unnecessary Privileges
Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-fe
- 7.7 High severity
Kibana: Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which could allow an attacker to read arbitrary files from the Kibana server filesystem, and perform Server-Side Request Forgery (SSRF) via Code Inje
- 7.5 High severity
Kibana: Inefficient Regular Expression Complexity
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blowup (CAPEC-492).
- 7.5 High severity
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in…
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153)
- 7.5 High severity
Packetbeat: Improper Validation of Array Index
Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Pack
- 8.6 High severity
Kibana: Server-Side Request Forgery
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This
- 7.5 High severity
Metricbeat: Improper Validation of Array Index
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server
- 7.4 High severity
Elasticsearch: Improper Authentication
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
- 8.8 High severity
Elastic Cloud Enterprise (ECE): Incorrect Authorization
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The list of APIs that are affected by this issue is: post:/platform/configuration/security/service-ac
- 7.0 High severity
Kibana: Improper Preservation of Permissions
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM. In some cases, this could result in local privilege escalation.
- 7.2 High severity
Elastic Cloud Enterprise (ECE): Improper Neutralization of Special Elements Used in a Template Engine
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variabl
- 7.0 High severity
Beats: Uncontrolled Search Path Element
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to
- 7.0 High severity
APM Server: Uncontrolled Search Path Element
An uncontrolled search path element vulnerability can lead to local privilege Escalation (LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An attacker with local access may exploit this flaw to
- 9.8 Critical severity
Kibana: Improperly Controlled Modification of Object Prototype Attributes
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
- 7.5 High severity
Elasticsearch: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- 7.8 High severity
Elastic Agent: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations.
- 7.1 High severity
Elastic Agent and Elastic Defend: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic has
- 7.5 High severity
Elasticsearch: Uncontrolled Resource Consumption
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- 9.9 Critical severity
Kibana: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2
- 9.0 Critical severity
Fleet Server: Exposure of Sensitive Information to an Unauthorized Actor
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
- 7.5 High severity
Elasticsearch: Allocation of Resources Without Limits or Throttling
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
- 7.2 High severity
Kibana: Deserialization of Untrusted Data
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privil
- 8.8 High severity
Kibana: Deserialization of Untrusted Data
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/secur
- 7.2 High severity
Kibana: Improperly Controlled Modification of Object Prototype Attributes
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary co
- 7.5 High severity
Elasticsearch: Missing Encryption of Sensitive Data
It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass
- 9.8 Critical severity
Elastic Cloud Enterprise: Improper Authorization
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges.
- 7.5 High severity
Elasticsearch: Uncontrolled Resource Consumption
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
- 7.5 High severity
APM Server: Insertion of Sensitive Information into Log File
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM
- 7.8 High severity
Elasticsearch-Hadoop: Deserialization of Untrusted Data
An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for rep
- 7.5 High severity
Elasticsearch: Improper Handling of Exceptional Conditions
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.
- 7.5 High severity
Elasticsearch: Out-of-bounds Write
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- 7.5 High severity
Elasticsearch: Uncontrolled Resource Consumption
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was
- 7.5 High severity
Beats: Improper Certificate Validation
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifica
- 7.5 High severity
Kibana: Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern
- 8.1 High severity
Fleet Server: Insertion of Sensitive Information into Log File
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially
- 9.1 Critical severity
Endpoint: Insertion of Sensitive Information into Log File
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API
- 8.8 High severity
Kibana: Improper Control of Generation of Code
Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on
- 8.8 High severity
Kibana: Improper Control of Generation of Code
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a specific payload that will attempt to execute JavaScript code. This could lead to the attacker executing
- 7.8 High severity
Elastic Endpoint Security: Improper Privilege Management
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
- 7.8 High severity
Elastic Endpoint Security: Improper Privilege Management
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.