https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:27:01 +0000 https://cve.radiocsirt.org/vuln/bit-elk-2026-72672 <p><strong>Affected:</strong> Bitnami: elk</p> <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana&#39;s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller&#39;s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> <p><strong>Affected:</strong> Bitnami: elk</p> <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana&#39;s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller&#39;s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> https://cve.radiocsirt.org/vuln/bit-elk-2026-72672 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1020 certfr-2026-avi-1020 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1020 https://cve.radiocsirt.org/vuln/euvd-2026-352347 EUVD-2026-352347 https://cve.radiocsirt.org/vuln/euvd-2026-352347 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72672 <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana&#39;s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller&#39;s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana&#39;s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller&#39;s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72672 https://cve.radiocsirt.org/vuln/ghsa-6c3r-vhrx-4vh9 <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana&#39;s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller&#39;s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> <p>The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana&#39;s internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller&#39;s Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.</p> https://cve.radiocsirt.org/vuln/ghsa-6c3r-vhrx-4vh9 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2824 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um vertrauliche Informationen einschließlich Zugangsdaten offenzulegen, Daten und Konfigurationen zu manipulieren, Berechtigungen zu umgehen und einen Denial of Service zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2824