medium6.5
CVE-2026-56151
Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153).
Impact
Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Kibana | from 8.0.0 before 8.19.17 from 9.0.0 before 9.3.6 from 9.4.0 before 9.4.3 |