Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-26939
6.5
MEDIUMCVSS v3
Severity scale
010
Description
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, process termination, and process suspension) via CAPEC-1 (Accessing Functionality Not Properly Constrained by ACLs). This requires an authenticated attacker with rule management privileges.
elastic/kibana
GitHubYour window into all of your data
GitHubYour window into all of your data>= 8.0.0, < 8.19.12, >= 9.0.0, < 9.2.6, = 9.3.0NVD
elastic/kibana
Docker HubThe Kibana docker images maintained by Elastic!
Docker HubThe Kibana docker images maintained by Elastic!>= 8.0.0, < 8.19.12, >= 9.0.0, < 9.2.6, = 9.3.0NVD