Elastic Security Updates – 22 July 2026

By /
  • 245/2026
  • High

Elastic has released security updates to address several vulnerabilities across Elasticsearch and Kibana.

The addressed vulnerabilities could allow the attacker to conduct denial-of-service attacks, trigger memory corruption, obtain sensitive information, manipulate data, and perform server-side request forgery (SSRF) attacks on the affected systems.

Sample of addressed vulnerabilities:

1. Authorization Bypass Through User-Controlled Key in Kibana Vulnerability (CVE-2026-56147):

  • CVSS: 7.1
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Obtain Information

2. Allocation of Resources Without Limits or Throttling in Kibana Vulnerability (CVE-2026-42397):

  • CVSS: 6.5
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Denial of Service
Vulnerabilities

Elastic Security Advisory

Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Elastic Security Advisory

References

Elastic Security Advisory