# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=3 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 4 --- ## [Kibana 8.19.20, 9.3.8, and 9.4.5 Security Update (ESA-2026-101)](https://discuss.elastic.co/t/kibana-8-19-20-9-3-8-and-9-4-5-security-update-esa-2026-101/389517)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-3-8-and-9-4-5-security-update-esa-2026-101/389517 "2026-08-13T10:47:58Z")
Uncaught Exception in Kibana Leading to Denial of Service Description: Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulatio… --- ## [Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-98)](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-98/389516)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-98/389516 "2026-08-13T10:47:55Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati… --- ## [Kibana 8.19.19 and 9.4.5 Security Update (ESA-2026-86)](https://discuss.elastic.co/t/kibana-8-19-19-and-9-4-5-security-update-esa-2026-86/389515)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-19-and-9-4-5-security-update-esa-2026-86/389515 "2026-08-13T10:47:52Z")
Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the ro… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-108)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-108/389514)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-108/389514 "2026-08-13T10:47:49Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-102)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-102/389513)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-102/389513 "2026-08-13T10:47:46Z")
Missing Authorization in Kibana Leading to Information Disclosure Description: Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (… --- ## [Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-94/389512)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-94/389512 "2026-08-13T10:47:42Z")
Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources vi… --- ## [Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511 "2026-08-13T10:47:39Z")
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation… --- ## [Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510 "2026-08-13T10:47:36Z")
Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-sup… --- ## [Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509 "2026-08-13T10:47:33Z")
Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-76)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508 "2026-08-13T10:47:29Z")
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-80)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-80/389507)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-80/389507 "2026-08-13T10:47:26Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an … --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-79)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-79/389506)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-79/389506 "2026-08-13T10:47:23Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque id… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-78)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-78/389505)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-78/389505 "2026-08-13T10:47:20Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific int… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-123)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504 "2026-08-13T10:47:17Z")
Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operati… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-120)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503 "2026-08-13T10:47:13Z")
Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-116)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-116/389502)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-116/389502 "2026-08-13T10:47:09Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CA… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-81)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-81/389501)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-81/389501 "2026-08-13T10:47:06Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply n… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-77)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500 "2026-08-13T10:47:03Z")
Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a … --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-133)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499 "2026-08-13T10:47:00Z")
Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service Description: Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exc… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-119)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498 "2026-08-13T10:46:56Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding… --- ## [Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-118)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-118/389497)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-118/389497 "2026-08-13T10:46:53Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated… --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-75)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-75/389496)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-75/389496 "2026-08-13T10:46:50Z")
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint to submit a request tha… --- ## [Elasticsearch 8.18.0, 9.0.0 Security Update (ESA-2026-111)](https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495 "2026-08-13T10:46:46Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of servic… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494 "2026-08-13T10:46:43Z")
Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-113)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493 "2026-08-13T10:46:40Z")
Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in E… --- ## [Kibana 8.19.20, 9.3.5, 9.4.2 Security Update (ESA-2026-136)](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:39am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492 "2026-08-13T10:39:59Z")
Uncaught Exception in Kibana Cases Leading to Denial of Service Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case … --- ## [Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-74)](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 11:08pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577 "2026-07-21T23:08:36Z")
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An a… --- ## [Kibana 9.4.4 Security Update (ESA-2026-73)](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 11:05pm UTC](https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-73/388576 "2026-07-21T23:05:08Z")
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-leve… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-72)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:55pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575 "2026-07-21T22:55:05Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authent… --- ## [Kibana 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-71)](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574)
**Author:** [@cronosda](https://discuss.elastic.co/u/cronosda)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 10:51pm UTC](https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574 "2026-07-21T22:51:22Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacke… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=2) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=4)