PT-2026-2849 · Elastic+1 · Kibana+1

Ikakavas + 1 · Publicado 2026-01-14 · Atualizado 2026-02-24 · CVE-2026-0532

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions prior to 8.19.10 Kibana versions prior to 9.1.10 Kibana versions prior to 9.2.4

Description An issue exists in Kibana where External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors. The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads. The vulnerability affects Kibana deployments globally and could allow authenticated users with connector privileges to read sensitive files and potentially steal secrets.

Recommendations Kibana versions prior to 8.19.10 should be upgraded to version 8.19.10 or later. Kibana versions prior to 9.1.10 should be upgraded to version 9.1.10 or later. Kibana versions prior to 9.2.4 should be upgraded to version 9.2.4 or later.

Correção

DoS

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BIT-ELK-2026-0532

BIT-KIBANA-2026-0532

CVE-2026-0532

Produtos afetados

Kibana

Red Os

Referências · 13

• https://twitter.com/CVEnew/status/2011555231189123558 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-kibana-2026-0532 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-0532 · Nota de Segurança
• https://twitter.com/ThreatSynop/status/2011404571722072467 · Publicação no Twitter
• https://twitter.com/ThreatSynop/status/2011405117593993579 · Publicação no Twitter
• https://twitter.com/rtfmkiesel/status/2011822702932217912 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2011408138759815252 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2011464734520840424 · Publicação no Twitter
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-kibana-cve-2026-0532-8.0 · Nota
• https://twitter.com/CCBalert/status/2011928520276967921 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-elk-2026-0532 · Aviso do Fabricante
• https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-05/384524 · Nota
• https://twitter.com/CveFindCom/status/2011417779220439343 · Publicação no Twitter