This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Elastic fixes 6 vulnerabilities
Elastic fixes 6 vulnerabilities in its products [1][2][3][4][5][6]. Products and their fixed versions: Kibana - 8.19.12, 9.2.6, 9.3.1 [1][2][4][5][6], Packetbeat - 8.19.11, 9.2.5 [3].
Due to insufficient handling of special elements in the templating mechanism in the Workflows functionality of Kibana, an authenticated remote attacker can read arbitrary files from the server's file system and carry out an SSRF attack [1].
The vulnerability is present in product:
- Kibana; >=9.0, <9.3.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2026-26938 at cve.org, NVD
- CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2026.
Due to insufficient validation of the amount of input data in Kibana, an authenticated remote attacker with view-only privileges can carry out a DoS attack by sending a specially crafted request.
The vulnerability is present in product:
- Kibana; >=8.18.0, <8.19.12
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-26934 at cve.org, NVD
- CWE-1284: Improper Validation of Specified Quantity in Input at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2026.
Due to insufficient array index validation in PostgreSQL protocol processing in Packetbeat, an unauthenticated remote attacker can carry out a DoS attack by sending a specially crafted packet. The vulnerability affects only instances where the pgsql protocol parser is explicitly enabled and configured [3].
The vulnerability is present in product:
- Packetbeat; >=8.0.0, <8.19.11; >=9.0.0, <9.2.5
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-26932 at cve.org, NVD
- CWE-129: Improper Validation of Array Index at cwe.mitre.org
The vulnerability was publicly disclosed 26. 2. 2026.
Links
- [1] https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253
- [2] https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-12/385248
- [3] https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247
- [4] https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-13/385249
- [5] https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-14/385250
- [6] https://discuss.elastic.co/t/kibana-8-19-11-9-2-5-security-update-esa-2026-15/385251
By CESNET, z.s.p.o. Henrieta Paločková on 3. 3. 2026.