# Security Announcements **URL:** https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=5 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 6 --- ## [Kibana 8.19.16, and 9.3.5 Security Update (ESA-2026-36)](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556 "2026-05-28T19:25:38Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-pri… --- ## [Kibana 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-35)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-35/386554)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-35/386554 "2026-05-28T19:25:21Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user ca… --- ## [Kibana 8.19.16, 9.3.5 Security Update (ESA-2026-34)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552 "2026-05-28T19:25:03Z")
Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A … --- ## [Kibana 8.19.16, 9.3.5 Security Update (ESA-2026-33)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-33/386551)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-33/386551 "2026-05-28T19:24:46Z")
Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disc… --- ## [Kibana 8.19.16, 9.3.5, 9.4.1 Security Update (ESA-2026-32)](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548 "2026-05-28T19:24:24Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user … --- ## [Kibana 8.19.16 and 9.3.5 Security Update (ESA-2026-30)](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 7:24pm UTC](https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545 "2026-05-28T19:24:06Z")
Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions cou… --- ## [Elastic Package Registry 1.38.0 Security Update (ESA-2026-27)](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 28, 2026, 9:11pm UTC](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081 "2026-04-28T21:11:09Z")
Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an atta… --- ## [Logstash 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-29)](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:32pm UTC](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816 "2026-04-08T16:32:14Z")
Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write a… --- ## [Kibana 9.3.3 Security Update (ESA-2026-28)](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:29pm UTC](https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815 "2026-04-08T16:29:23Z")
Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with wor… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-26)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:25pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814 "2026-04-08T16:25:26Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user wi… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-25)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:22pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813 "2026-04-08T16:22:12Z")
Incorrect Authorization in Kibana Fleet Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet age… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-24)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-24/385812)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:18pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-24/385812 "2026-04-08T16:18:41Z")
Incorrect Authorization in Kibana Fleet Leading to Information Disclosure Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privile… --- ## [Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-21)](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [April 8, 2026, 4:01pm UTC](https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-21/385811 "2026-04-08T16:01:33Z")
Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers ca… --- ## [Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)](https://discuss.elastic.co/t/elastic-otel-java-1-10-0-security-update-esa-2026-22-ghsa-xw7x-h9fj-p2c7/385700)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 30, 2026, 2:17pm UTC](https://discuss.elastic.co/t/elastic-otel-java-1-10-0-security-update-esa-2026-22-ghsa-xw7x-h9fj-p2c7/385700 "2026-03-30T14:17:53Z")
Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component (CWE-1395) exists in Elastic OTel Java via a dependency on OpenTelemetr… --- ## [Kibana 8.19.13, 9.2.7, 9.3.2 Security Update (ESA-2026-20)](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:59pm UTC](https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535 "2026-03-19T16:59:58Z")
Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of S… --- ## [Elasticsearch 8.19.8, 9.1.8 Security Update (ESA-2026-18)](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-security-update-esa-2026-18/385534)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:59pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-security-update-esa-2026-18/385534 "2026-03-19T16:59:18Z")
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component (CWE-1395) exists in PyTorch used by the machine learning model loading component in Ela… --- ## [Packetbeat 8.19.11, 9.2.5 Security Update (ESA-2026-11)](https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:56pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533 "2026-03-19T16:56:17Z")
Improper Validation of Array Index in Packetbeat Leading to Denial of Service Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data M… --- ## [Metricbeat 8.19.13, 9.2.5 Security Update (ESA-2026-09)](https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:54pm UTC](https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532 "2026-03-19T16:54:15Z")
Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote\_write HTTP handler in Metricbeat can lead Denial of S… --- ## [Logstash 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-06)](https://discuss.elastic.co/t/logstash-8-19-10-9-1-10-9-2-4-security-update-esa-2026-06/385531)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:53pm UTC](https://discuss.elastic.co/t/logstash-8-19-10-9-1-10-9-2-4-security-update-esa-2026-06/385531 "2026-03-19T16:53:51Z")
Sensitive Information in Resource Not Removed Before Reuse in Logstash Leading to Access to Sensitive Information Dependency on Vulnerable Third-Party Component (CWE-1395) exists in org.lz4:lz4-java decompression librar… --- ## [Kibana 8.19.12, 9.2.6, 9.3.1 Security Update (ESA-2026-19)](https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 4:51pm UTC](https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-19/385530 "2026-03-19T16:51:08Z")
Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response… --- ## [Kibana 9.3.1 Security Update (ESA-2026-17)](https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:55pm UTC](https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253 "2026-02-26T16:55:40Z")
Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) ex… --- ## [Synthetics Recorder 1.4.15 Security Update (ESA-2026-16) - CVE-2025-6554 and CVE-2025-7657](https://discuss.elastic.co/t/synthetics-recorder-1-4-15-security-update-esa-2026-16-cve-2025-6554-and-cve-2025-7657/385252)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:55pm UTC](https://discuss.elastic.co/t/synthetics-recorder-1-4-15-security-update-esa-2026-16-cve-2025-6554-and-cve-2025-7657/385252 "2026-02-26T16:55:04Z")
Dependency on Vulnerable Third-Party Component in Synthetics Recorder Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component (CWE-1395) exists in the bundled Chromium browser in Elastic Synthet… --- ## [Kibana 8.19.11, 9.2.5 Security Update (ESA-2026-15)](https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-15/385251)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:54pm UTC](https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-15/385251 "2026-02-26T16:54:16Z")
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) … --- ## [Kibana 8.19.11, 9.2.5 Security Update (ESA-2026-14)](https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-14/385250)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:53pm UTC](https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-14/385250 "2026-02-26T16:53:47Z")
Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Reg… --- ## [Kibana 8.19.12, 9.2.6, 9.3.1 Security Update (ESA-2026-13)](https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-13/385249)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:53pm UTC](https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-13/385249 "2026-02-26T16:53:12Z")
Improper Input Validation in Kibana Leading to Denial of Service Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CA… --- ## [Kibana 8.19.12, 9.2.6, 9.3.1 Security Update (ESA-2026-12)](https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-12/385248)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:52pm UTC](https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-12/385248 "2026-02-26T16:52:37Z")
Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privil… --- ## [Packetbeat 8.19.11, 9.2.5 Security Update (ESA-2026-10)](https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 4:51pm UTC](https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247 "2026-02-26T16:51:41Z")
Improper Validation of Array Index in Packetbeat Leading to Denial of Service Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipu… --- ## [Elasticsearch 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-07)](https://discuss.elastic.co/t/elasticsearch-8-19-10-9-1-10-9-2-4-security-update-esa-2026-07/384525)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:55pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-10-9-1-10-9-2-4-security-update-esa-2026-07/384525 "2026-01-13T20:55:33Z")
Elasticsearch yawkat LZ4 Java - CVE-2025-66566 (ESA-2026-07) An Information Disclosure vulnerability (CVE-2025-66566) exists in the yawkat LZ4 Java library used by Elasticsearch that allows an attacker to read previous … --- ## [Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-05)](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:54pm UTC](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524 "2026-01-13T20:54:48Z")
External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector (ESA-2026-05) External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-9… --- ## [Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-08)](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-08/384523)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:47pm UTC](https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-08/384523 "2026-01-13T20:47:35Z")
Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation (ESA-2026-08) Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (C… [Previous page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=4) [Next page](https://discuss.elastic.co/c/announcements/security-announcements/31.md?page=6)