PT-2026-2849 · Elastic+1 · Kibana+1

Ikakavas

+1

·

Published

2026-01-14

·

Updated

2026-02-24

·

CVE-2026-0532

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Kibana versions prior to 8.19.10 Kibana versions prior to 9.1.10 Kibana versions prior to 9.2.4
Description An issue exists in Kibana where External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure. This requires an attacker to have authenticated access with privileges sufficient to create or modify connectors. The server processes a configuration without proper validation, allowing for arbitrary network requests and for arbitrary file reads. The vulnerability affects Kibana deployments globally and could allow authenticated users with connector privileges to read sensitive files and potentially steal secrets.
Recommendations Kibana versions prior to 8.19.10 should be upgraded to version 8.19.10 or later. Kibana versions prior to 9.1.10 should be upgraded to version 9.1.10 or later. Kibana versions prior to 9.2.4 should be upgraded to version 9.2.4 or later.

Fix

DoS

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-ELK-2026-0532
BIT-KIBANA-2026-0532
CVE-2026-0532

Affected Products

Kibana
Red Os