# Kibana 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-204)

**URL:** <https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358>\
**Category:** Security Announcements\
**Created:** [November 3, 2026, 4:27pm UTC](https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358 "2026-11-03T16:27:38Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [November 3, 2026, 4:27pm UTC](https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358/1 "2026-11-03T16:27:38Z")

</div>

**Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure**

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

**Affected Versions:**

> - 8.x: All versions from 8.10.0 up to and including 8.19.23
> - 9.x:

- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5

**Affected Configurations:**

> - Self-managed Kibana deployments that embed credentials in the Elasticsearch host URLs of the Kibana configuration, and, in versions 8.16.0 and later also do not set a public Elasticsearch base URL.
> - Deployments that supply the Kibana credentials through the dedicated username and password settings or a service account token are **not** affected. Elastic Cloud Hosted deployments are **not** affected.

**Solutions and Mitigations:**

The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes) for your target version before upgrading.

If your deployment had credentials in the Elasticsearch host URLs, rotate those credentials after you upgrade.

**For Users that Cannot Upgrade:**

**Self-hosted**

> - Remove the credentials from elasticsearch.hosts in kibana.yml. Configure them with elasticsearch.serviceAccountToken, or with elasticsearch.username and elasticsearch.password, then rotate the credentials.
> - Alternatively, on Kibana version 8.16.0 and later set elasticsearch.publicBaseUrl in kibana.yml to the Elasticsearch URL without credentials, then rotate the credentials.

**Cloud**

> - Elastic Cloud Hosted deployments are not affected. No action is necessary.

**Indicators of Compromise (IOC)**

If Elasticsearch audit logging is enabled, look for authentication events that use the Kibana service credentials from a source address that is not one of your Kibana instances.

**Elastic Cloud Serverless**

Elastic Cloud Hosted and Elastic Cloud Serverless are not affected by this vulnerability.

**Severity:** CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N  
**CVE ID:** CVE-2026-115293  
**Problem Type:** CWE-201 - Insertion of Sensitive Information Into Sent Data

---

_[View the full topic](https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358)._