# Announcements **URL:** https://discuss.elastic.co/c/announcements/5.md?page=3 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 4 --- ## [Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-92)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-92/389526)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-92/389526 "2026-08-13T10:48:28Z")
Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification Description: Missing Authorization (CWE-862) in Kibana can lead to cross-space informati… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-88/389525)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-88/389525 "2026-08-13T10:48:24Z")
Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts ma… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-87/389524 "2026-08-13T10:48:21Z")
Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire confi… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-110/389523 "2026-08-13T10:48:18Z")
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-106)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-106/389522)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-106/389522 "2026-08-13T10:48:15Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-105)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-105/389521 "2026-08-13T10:48:11Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Function… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-104)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520 "2026-08-13T10:48:08Z")
Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service Description: Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A spe… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-100)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-100/389519)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-100/389519 "2026-08-13T10:48:05Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Description: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excess… --- ## [Kibana 8.19.20, and 9.4.4 Security Update (ESA-2026-90)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-4-security-update-esa-2026-90/389518)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-4-security-update-esa-2026-90/389518 "2026-08-13T10:48:02Z")
Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations Description: Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locati… --- ## [Kibana 8.19.20, 9.3.8, and 9.4.5 Security Update (ESA-2026-101)](https://discuss.elastic.co/t/kibana-8-19-20-9-3-8-and-9-4-5-security-update-esa-2026-101/389517)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-3-8-and-9-4-5-security-update-esa-2026-101/389517 "2026-08-13T10:47:58Z")
Uncaught Exception in Kibana Leading to Denial of Service Description: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulatio… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-98/389516)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-98/389516 "2026-08-13T10:47:55Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 8.19.19 and 9.4.5 Security Update (ESA-2026-86)](https://discuss.elastic.co/t/kibana-8-19-19-and-9-4-5-security-update-esa-2026-86/389515)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-19-and-9-4-5-security-update-esa-2026-86/389515 "2026-08-13T10:47:52Z")
Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the ro… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-108/389514)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-108/389514 "2026-08-13T10:47:49Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-102/389513)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-102/389513 "2026-08-13T10:47:46Z")
Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-94/389512)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-94/389512 "2026-08-13T10:47:42Z")
Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources vi… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511 "2026-08-13T10:47:39Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation… --- ## [Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510 "2026-08-13T10:47:36Z")
Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-sup… --- ## [Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509 "2026-08-13T10:47:33Z")
Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-76)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508 "2026-08-13T10:47:29Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-80/389507)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-80/389507 "2026-08-13T10:47:26Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an … --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-79)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-79/389506)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-79/389506 "2026-08-13T10:47:23Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque id… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-78)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-78/389505)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-78/389505 "2026-08-13T10:47:20Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific int… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-123)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504 "2026-08-13T10:47:17Z")
Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operati… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-120)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503 "2026-08-13T10:47:13Z")
Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-116)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-116/389502)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-116/389502 "2026-08-13T10:47:09Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CA… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-81)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-81/389501)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-81/389501 "2026-08-13T10:47:06Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply n… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-77)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500 "2026-08-13T10:47:03Z")
Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a … --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-133)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499 "2026-08-13T10:47:00Z")
Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service Description: Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exc… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-119)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498 "2026-08-13T10:46:56Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-118)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-118/389497)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-118/389497 "2026-08-13T10:46:53Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated… [Previous page](https://discuss.elastic.co/c/announcements/5.md?page=2) [Next page](https://discuss.elastic.co/c/announcements/5.md?page=4)