This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Elastic fixes 48 vulnerabilities
Elastic fixes 48 vulnerabilities in its products. The most severe of them are described below, the rest can be found at [1]. Products and their fixed versions [1]: Elasticsearch - 8.19.20, 9.3.8, 9.4.5, 9.5.1 Elastic Kibana - 8.19.20, 9.3.8, 9.4.5, 9.5.1 Fleet Server - 8.19.20, 9.4.5, 9.5.1 Elastic Cloud on Kubernetes - 3.5.0
An authenticated remote attacker with the right to deploy a trained model can use a modified model to write outside the bounds of allocated memory, which may lead to a process crash or code execution [2].
The vulnerability is present in product:
- Elasticsearch; >=8.19.0, <8.19.20; >=9.4.0, <9.4.5; 9.5.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-72642 at cve.org, NVD
- CWE-823: Use of Out-of-range Pointer Offset at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2026.
Due to missing authorization, an authenticated remote attacker with permission to write detection rules can run actions on managed hosts without authorization, which may lead to data leakage as well as unauthorized changes to their state [3].
The vulnerability is present in product:
- Kibana; >=8.5.0, <8.19.20; >=9.0.0, <9.4.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-72665 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2026.
Due to insufficient sanitization of the output configuration identifier, an authenticated remote attacker can inject code into a script executed on the server [4].
The vulnerability is present in product:
- Fleet Server; >=8.5.0, <8.19.20; >=9.0.0, <9.4.5; >=9.5.0, <9.5.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-72676 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2026.
An authenticated remote attacker restricted to their own namespace can use an annotation to abuse the operator, which has higher privileges, to copy a secret from any other namespace [5].
The vulnerability is present in product:
- Elastic Cloud on Kubernetes; <3.5.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-72640 at cve.org, NVD
- CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2026.
Links
- [1] https://discuss.elastic.co/c/announcements/5
- [2] https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-123/389504
- [3] https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-96/389528
- [4] https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510
- [5] https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494
By CESNET, z.s.p.o. Henrieta Paločková on 17. 8. 2026.