This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Elastic fixes 3 vulnerabilities in Kibana
Elastic fixes 3 vulnerabilities in Kibana in versions 8.19.9, 9.1.9 and 9.2.3 [1][2][3].
An authenticated remote attacker can cause a DoS attack by sending a large number of specially crafted requests to the Kibana Fleet component [1].
The vulnerability is present in product:
- Kibana Fleet; >=7.10.0, <7.17.29; >=8.0.0, <8.19.9; >=9.0.0, <9.1.9; >=9.2.0, <9.2.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-0530 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
An authenticated remote attacker with privileges to perform operations in connectors can enter a specially crafted e-mail address into the e-mail connector and thereby cause a DoS attack [3].
The vulnerability is present in product:
- Kibana; >=7.0.0, <8.19.9; >=9.0.0, <9.1.9; >=9.2.0, <9.2.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-0543 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 13. 1. 2026.
Links
By CESNET, z.s.p.o. Martin Krajči on 14. 1. 2026.