Vulnerability in Elastic Kibana

[ Description ]Official description

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR4 Nov 2026CERTFR-2026-AVI-1461

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2026-115292CVE-2026-91403CVE-2026-115710+13 more CVEs
• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4336

  Kibana: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-115293CVE-2026-115292CVE-2026-115295+1 more CVEs

[ References ]References

• discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-204/391358