# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?no_subcategories=false&page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-198)](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-198/390872)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:52pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-198/390872 "2026-10-06T18:52:02Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct an… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:51pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871 "2026-10-06T18:51:14Z")
Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fu… --- ## [Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-2-security-update-esa-2026-196/390870)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:50pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-2-security-update-esa-2026-196/390870 "2026-10-06T18:50:30Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggreg… --- ## [Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-195)](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:49pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869 "2026-10-06T18:49:46Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CA… --- ## [Elastic Agent / Endpoint 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-194)](https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:47pm UTC](https://discuss.elastic.co/t/elastic-agent-endpoint-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-194/390868 "2026-10-06T18:47:56Z")
Uncaught Exception in Elastic Endpoint Leading to Denial of Service Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoin… --- ## [Kibana 9.4.8, 9.5.5 Security Update (ESA-2026-193)](https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:44pm UTC](https://discuss.elastic.co/t/kibana-9-4-8-9-5-5-security-update-esa-2026-193/390866 "2026-10-06T18:44:15Z")
Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained… --- ## [Elasticsearch 9.4.7, 9.5.3, 8.19.23 Security Update (ESA-2026-192)](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:43pm UTC](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865 "2026-10-06T18:43:29Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… --- ## [Kibana 9.4.0 Security Update (ESA-2026-191)](https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:42pm UTC](https://discuss.elastic.co/t/kibana-9-4-0-security-update-esa-2026-191/390864 "2026-10-06T18:42:33Z")
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An i… --- ## [Elasticsearch 9.4.8, 9.5.5 Security Update (ESA-2026-190)](https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:41pm UTC](https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863 "2026-10-06T18:41:32Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in… --- ## [Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:39pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862 "2026-10-06T18:39:39Z")
Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponent… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-188)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861 "2026-10-06T18:37:40Z")
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality … --- ## [Kibana 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-187)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:36pm UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-4-security-update-esa-2026-187/390860 "2026-10-06T18:36:48Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In … --- ## [Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-185)](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [October 6, 2026, 6:34pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859 "2026-10-06T18:34:52Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-priv… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-184)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-3-security-update-esa-2026-184/390688 "2026-09-25T08:35:53Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-183)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687 "2026-09-25T08:35:28Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 9.4.7, 9.5.4 Security Update (ESA-2026-182)](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686 "2026-09-25T08:35:05Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-181)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:34am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685 "2026-09-25T08:34:42Z")
Uncontrolled Resource Consumption in Kibana Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) Affected Versions: 8.x: A… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-180)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-180/390684 "2026-09-25T08:34:19Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-179)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683 "2026-09-25T08:33:56Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) Affected Vers… --- ## [Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-176)](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682 "2026-09-25T08:33:33Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected … --- ## [Elasticsearch 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-170)](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-3-security-update-esa-2026-170/390681 "2026-09-25T08:33:09Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). Affected … --- ## [Kibana 8.19.22, 9.4.7, 9.5.3 Security Update (ESA-2026-139)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:32am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-139/390680 "2026-09-25T08:32:46Z")
Missing Authorization in Kibana Leading to Unauthorized Deletion of Data Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security … --- ## [Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)](https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:32am UTC](https://discuss.elastic.co/t/kibana-8-19-22-9-4-6-security-update-esa-2026-103/390679 "2026-09-25T08:32:22Z")
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthor… --- ## [Kibana 9.4.7, 9.5.0 Security Update (ESA-2026-85)](https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678)
**Author:** [@kruskall](https://discuss.elastic.co/u/kruskall)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:31am UTC](https://discuss.elastic.co/t/kibana-9-4-7-9-5-0-security-update-esa-2026-85/390678 "2026-09-25T08:31:59Z")
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A n… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-178)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-178/390164)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:03pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-178/390164 "2026-09-03T18:03:25Z")
Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured … --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-175)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:03pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-175/390163 "2026-09-03T18:03:02Z")
Incorrect Authorization in Kibana Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CA… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-174)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-174/390162)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:02pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-174/390162 "2026-09-03T18:02:39Z")
Incorrect Authorization in Kibana Leading to Denial of Service Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). … --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:02pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-154/390161 "2026-09-03T18:02:15Z")
Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to u… --- ## [Kibana 9.4.6, 9.5.3 Security Update (ESA-2026-153)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-3-security-update-esa-2026-153/390160 "2026-09-03T18:01:52Z")
Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature c… --- ## [Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-151)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 6:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-3-security-update-esa-2026-151/390159 "2026-09-03T18:01:27Z")
Improper Control of Generation of Code in Kibana Leading to Privilege Escalation An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?no_subcategories=false) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?no_subcategories=false&page=2)