Kibana vulnerabilities and fixes

CVEs that mention Kibana, ranked by priority. 10 tracked.

Kibana has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-08-13. Highest priority: CVE-2026-63260 (score 33/100).

• CVE-2026-63260 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (
• CVE-2026-63261 MEDIUM 6.5 UPGRADE Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (
• CVE-2026-72663 MEDIUM 6.5 UPGRADE Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulati
• CVE-2026-72653 MEDIUM 6.5 UPGRADE Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Exc
• CVE-2026-63141 MEDIUM 6.3 UPGRADE Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect conf
• CVE-2026-63142 MEDIUM 5.0 UPGRADE Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to th
• CVE-2026-63143 MEDIUM 4.3 UPGRADE Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse
• CVE-2026-63145 MEDIUM 4.3 UPGRADE Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and not
• CVE-2026-63259 MEDIUM 4.3 UPGRADE Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via us
• CVE-2026-63262 MEDIUM 4.3 UPGRADE Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user

FAQ

How do I fix Kibana vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Kibana being exploited right now?

None of the tracked Kibana CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Kibana CVE should I patch first?

CVE-2026-63260 currently ranks highest (33/100): Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (.

← Back to latest CVEs