Multiple vulnerabilities affecting Elastic Kibana

Kibana is an open source data visualization tool built for Elasticsearch, allowing users to create interactive dashboards, charts, and maps to explore, analyze, and present their data. This product is affected by several vulnerabilities labeled as follows: CVE-2026-63137: This vulnerability results from incorrect authorization (CWE-863). Exploitation of this vulnerability would allow an authenticated attacker with workflow editing permissions to execute scheduled workflows with the privileges of another, more privileged user, thereby allowing access and modification of data beyond their own permission scope. This vulnerability is classified as high with a severity score of 8.3 according to CVSS v3.1. CVE-2026-78592: This vulnerability is due to incorrect limitation of the path to a restricted directory (‘Path Traversal’ CWE-22). Exploitation of this vulnerability would allow an authenticated attacker with tag creation privileges to cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources, including administrative accounts and other organizational assets. Exploitation would require administrator interaction with the affected interface. This vulnerability is classified as high with a severity score of 7.3 according to CVSS v3.1. CVE-2026-78590: This vulnerability is caused by an incorrect restriction of the path to a restricted directory ('Path Traversal' CWE-22) in the Fleet functionality of Kibana. Exploitation of this vulnerability would allow an authenticated attacker, with write access to Fleet settings, to cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation would require administrator interaction with the affected Fleet interface. This vulnerability is classified as high with a severity score of 7.3 according to CVSS v3.1. CVE-2026-82302: This vulnerability results from incorrect authorization (CWE-863). Exploitation of this vulnerability would allow an authenticated attacker to modify configurations in an unauthorized manner. This vulnerability is classified as high with a severity score of 8.1 according to CVSS v3.1. CVE-2026-78583: This vulnerability results from incorrect authorization (CWE-863). Exploitation of this vulnerability would allow an authenticated attacker with Fleet management privileges to manipulate Elasticsearch cluster privilege claims from integration packages. This could lead to each Elastic Agent in a targeted policy receiving accreditation with arbitrarily elevated Elasticsearch cluster privileges, including full cluster administration. This vulnerability is classified as high with a severity score of 8.1 according to CVSS V3.1.

• CVE-2026-63137: Kibana versions prior to 9.4.3;
• CVE-2026-78592: Kibana versions prior to 8.19.16, 9.3.5 and 9.4.2;
• CVE-2026-78590: Kibana versions prior to 8.19.18, 9.3.6 and 9.4.3;
• CVE-2026-82302: Kibana versions prior to 8.19.22, 9.4.7 and 9.5.3;
• CVE-2026-78583: Kibana versions prior to 8.19.21, 9.4.6 and 9.5.3;