Elastic Stack Under Fire: 7 New Flaws Expose Files & Crash Servers

Elastic has released a comprehensive security update addressing seven distinct vulnerabilities across Elasticsearch, Kibana, Packetbeat, and Metricbeat, warning administrators to patch urgently to prevent arbitrary file access and potential DoS impacts. The most severe flaw is CVE-2026-0532, a high-severity issue in the Google Gemini connector (CVSS 8.6) that enables SSRF and Arbitrary File Disclosure due to insufficient validation when processing configuration data.

Elasticsearch itself carries an Information Disclosure flaw in the yawkat LZ4 Java library (CVSS 8.4) that could let an attacker read previous buffer contents via crafted compressed input, with a mitigation to switch the transport compression scheme to deflate or disable compression. The update also patches three Denial-of-Service vulnerabilities in Kibana, including Email Connector Crash (CVE-2026-0543), Fleet Database Overload (CVE-2026-0531) and Resource Exhaustion (CVE-2026-0530).

In the Beats family, Packetbeat (CVE-2026-0529) and Metricbeat (CVE-2026-0528) receive fixes for buffer and validation flaws, respectively. Elastic has released versions 8.19.10, 9.1.10, and 9.2.4 to resolve all seven vulnerabilities, and users are urged to upgrade their stacks immediately.