Data Management and Analytics

In Kibana all versions from 9.3.0 up to and including 9.3.2 a high severity vulnerability CVE-2026-33458 was detected. This vulnerability allows authenticated users with workflow creation and execution privileges to perform server-side request forgery (SSRF) by bypassing host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data. To address this issue, users should upgrade Kibana to version 9.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33458.

In Kibana all versions from 8.0.0 up to and including 8.19.13, all versions from 9.0.0 up to and including 9.2.7 and all versions from 9.3.0 up to and including 9.3.2 a high severity vulnerability CVE-2026-4498 was detected. This vulnerability allows authenticated users with Fleet sub-feature privileges to read index data beyond their intended Elasticsearch RBAC scope due to execution with unnecessary privileges in debug route handlers. To address this issue, users should upgrade Kibana to versions 8.19.14, 9.2.8, or 9.3.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-4498.

In MLflow versions before v3.7.0 a critical severity vulnerability CVE-2025-15036 was detected. A path traversal flaw in the extract_archive_to_dir function allows crafted tar archives to write files outside the intended extraction directory by using malicious member paths. To address this issue, users should update MLflow to versions v3.7.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-15036.

In MLflow version 3.8.0 a critical severity vulnerability CVE-2025-15379 was detected. This vulnerability allows attackers to execute arbitrary commands by supplying a malicious model artifact, as dependency specifications from the python_env.yaml file are unsafely interpolated into shell commands in the _install_model_dependencies_to_env() function when using env_manager=LOCAL. To address this issue, users should upgrade MLflow to version 3.8.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-15379.

In Kibana all versions from 8.0.0 up to and including 8.19.12, all versions from 9.0.0 up to and including 9.2.6, all versions from 9.3.0 up to and including 9.3.1 a medium severity vulnerability CVE-2026-26940 was detected. This vulnerability allows an authenticated user to send a specially crafted Timelion expression with an excessively large quantity value, causing internal series data properties to be overwritten and resulting in a Denial of Service via excessive resource allocation. To address this issue, users should upgrade Kibana to versions 8.19.13, 9.2.7 or 9.3.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26940.

In Kibana all versions from 8.0.0 up to and including 8.19.11, all versions from 9.0.0 up to and including 9.2.5, and version 9.3.0 a high severity vulnerability CVE-2026-26939 was detected. This vulnerability allows an authenticated attacker with rule management privileges to bypass server-side authorization in the Detection Rule Management system, enabling unauthorized configuration of endpoint response actions such as host isolation, process termination, and process suspension. To address this issue, users should upgrade Kibana to versions 8.19.12, 9.2.6 or 9.3.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26939.

In Jenkins versions 2.550 and earlier, including LTS 2.541.1 and earlier a medium severity vulnerability CVE-2026-27100 was detected. This vulnerability allows attackers with Item/Build and Item/Configure permissions to submit Run Parameter values referencing builds they do not have access to, thereby disclosing information about the existence of jobs, builds, and build display names. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27100.

In Graylog version 2.2.3 a medium severity vulnerability CVE-2026-1438 was detected. This vulnerability allows attackers to inject and execute arbitrary JavaScript code in a victim’s browser via a reflected Cross-Site Scripting (XSS) flaw in the Web Interface console due to improper sanitization and escaping of URL segments in the ‘/system/nodes/’ endpoint. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1438.