https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:12:12 +0000 https://cve.radiocsirt.org/vuln/bit-elk-2026-72668 <p><strong>Affected:</strong> Bitnami: elk</p> <p>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.</p> <p><strong>Affected:</strong> Bitnami: elk</p> <p>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.</p> https://cve.radiocsirt.org/vuln/bit-elk-2026-72668 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1228 certfr-2026-avi-1228 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1228 https://cve.radiocsirt.org/vuln/euvd-2026-377918 EUVD-2026-377918 https://cve.radiocsirt.org/vuln/euvd-2026-377918 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72668 <p>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.</p> <p>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72668 https://cve.radiocsirt.org/vuln/ghsa-r4ff-jqf2-8p5g <p>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.</p> <p>Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.</p> https://cve.radiocsirt.org/vuln/ghsa-r4ff-jqf2-8p5g https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3575 <p>Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, und um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um seine Privilegien zu erhöhen, und um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3575