- Top reward
- $9,000
- Top severity paid
- Critical
- Assets in scope
- 34
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays up to $9,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$9,000 from $800 |
| High |
|
$4,000 from $300 |
| Medium |
|
$1,500 from $100 |
| Low |
|
$700 from $50 |
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
34 assets you may test, 39 excluded.
Wildcard domains 31
- *.ela.st Critical
- *.elasticacademy.com Critical
- *.elasticaccelerationzone.co Critical
- *.elasticapm.co Critical
- *.elasticbeats.wtf Critical
- *.elasticcloud.wtf Critical
- *.elastic.co Critical
- *.elastic.dev Critical
- *.elasticgov.com Critical
- *.elasticloud.wtf Critical
- *.elasticnet.co Critical
- *.elasticon.co Critical
- *.elasticon.com Critical
- *.elasticpartneracademy.com Critical
- *.elasticps.co Critical
- *.elasticsearch.com Critical
- *.elasticsearch.fr Critical
- *.elasticsearch.jp Critical
- *.elasticsearch.org Critical
- *.elasticsearch.wtf Critical
- *.elastic.wtf Critical
- *.elstc.co Critical
- *.eops.nl Critical
- *.estccdn.com Critical
- *.found.io Critical
- *.insight.io Critical
- *.kibana.wtf Critical
- *.logstash.net Critical
- *.logstash.wtf Critical
- *.prelert.com Critical
- *.theelasticast.com Critical
Products and areas 3
- Elastic Credentials High
- Software Supply Chain Critical
- Subdomain takeover Low
Out of scope (39)
- Beats
- Beats - Auditbeat
- Beats - Filebeat
- Beats - Heartbeat
- Beats - Metricbeat
- Beats - Osquerybeat
- Beats - Packetbeat
- Beats - Winlogbeat
- Elastic Agent
- Elastic Cloud Enterprise (ECE)
- Elastic Cloud on Kubernetes (ECK)
- Elastic Defend
- Elastic Distributions of OpenTelemetry (EDOT)
- Elastic Enterprise Search
- Elastic Maps Server
- Elasticsearch
- Fleet Server
- Kibana
- Logstash
- Observability - APM Agents
- Observability - APM Server
- Elastic Clients
- Elastic Package Registry
- Elastic Synthetics Monitoring
- Other
- cloud.elastic.co
- community.elastic.co
- discuss.elastic.co
- learn.elastic.co
- link.email.elastic.co
- sendgrid.elastic.co
- track.email.elastic.co
- *.es.io
- github.com/elastic/*/wiki
- github.com/swiftype/*/wiki
- *.jina.ai
- *.kbndev.co
- *.keephq.dev
- *.swiftype.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Elastic (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Application‑layer attacks should be reproduced on a deployment that meets the minimum requirements specified in the product documentation, and in all cases with no less than 1 CPU and 2 GB of RAM.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
-
Follow HackerOne's disclosure guidelines.
Not accepted
-
Findings that require administrative or root operating system privileges
-
Findings that require administrative level of access to our products and where the impact/severity is limited to Low for Availability
-
Subdomain takeovers on typosquatted domains or parked/reserved domains for phishing
-
Application-level Denial of Service attacks against Swiftype
-
Cross-site scripting vulnerabilities that are not accompanied by a bypass of our content security policy
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device
-
Previously known vulnerable libraries without a working Proof of Concept
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Missing best practices in SSL/TLS configuration
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Lack of Rate limiting or bruteforce issues
-
Missing best practices in Content Security Policy
-
Missing HttpOnly or Secure flags on cookies
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
-
Tabnabbing
-
Issues that require unlikely user interaction
-
Open Redirects that are not chained into a more impactful vulnerability
-
Broken links in documentation
-
Issues where an attacker gets access to paid features for free or at a discount
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 4 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://github.com/elastic/*/wiki (out of scope)
-
Scope added
https://github.com/swiftype/*/wiki (out of scope)
-
Scope added
Elastic Credentials
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-115706 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages. | Medium 6.8 | 29 Oct 2026 |
| CVE-2026-115713 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132). | High 7.5 | 29 Oct 2026 |
| CVE-2026-115712 | Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change. | Medium 4.3 | 29 Oct 2026 |
| CVE-2026-115711 | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container confi | Medium 6.4 | 29 Oct 2026 |
| CVE-2026-115709 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132). | High 8.2 | 29 Oct 2026 |
| CVE-2026-115708 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132). | High 7.2 | 29 Oct 2026 |
| CVE-2026-115707 | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read th | Medium 6.4 | 29 Oct 2026 |
| CVE-2026-103006 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-103009 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check | High 7.1 | 6 Oct 2026 |
| CVE-2026-103008 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-103007 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indic | High 7.2 | 6 Oct 2026 |
| CVE-2026-103005 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available he | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-102411 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* clu | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-102412 | Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted to users with Fleet settings administrative access. Successful exploitation could allow an attacker | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-102410 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the same feature did enforce. As a result, a user who held only data-store-level read access to an inde | Medium 4.3 | 6 Oct 2026 |
| CVE-2026-102409 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130). | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-102408 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated us | Medium 4.3 | 6 Oct 2026 |
| CVE-2026-102407 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting | Medium 5.4 | 6 Oct 2026 |
| CVE-2026-102406 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch | High 8.8 | 6 Oct 2026 |
| CVE-2026-102404 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, incl | Medium 6.5 | 6 Oct 2026 |
| CVE-2026-94400 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-94408 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | Medium 4.9 | 26 Sep 2026 |
| CVE-2026-82300 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-94399 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-94398 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-82294 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-94397 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-94396 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | Medium 6.5 | 26 Sep 2026 |
| CVE-2026-78583 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to rece | High 8.1 | 3 Sep 2026 |
| CVE-2026-78609 | Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace. | Medium 5.4 | 2 Sep 2026 |
| CVE-2026-78604 | Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls broader than required. A local user could take advantage of this to cause the service to execute code o | High 7.8 | 2 Sep 2026 |
| CVE-2026-78591 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources incl | Medium 6.3 | 2 Sep 2026 |
| CVE-2026-78602 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process. | Medium 5.3 | 2 Sep 2026 |
| CVE-2026-78601 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task to read from Elasticsearch indices that user is not authorized to access. Derived entity data from | Medium 5.5 | 2 Sep 2026 |
| CVE-2026-78600 | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read access to the associated Elasticsearch cluster. | Low 3.5 | 2 Sep 2026 |
| CVE-2026-78599 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to intera | Medium 6.5 | 2 Sep 2026 |
| CVE-2026-78598 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning job management privileges within a single Kibana space could cause a job's saved object to become accessible across all spaces in the Kibana instance, without hold | Medium 5.4 | 2 Sep 2026 |
| CVE-2026-78594 | Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every | Medium 4.9 | 2 Sep 2026 |
| CVE-2026-78586 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users. | Medium 6.5 | 2 Sep 2026 |
| CVE-2026-78590 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged reso | High 7.3 | 2 Sep 2026 |
| CVE-2026-78588 | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process. | Medium 6.5 | 2 Sep 2026 |
| CVE-2026-78587 | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents. | Low 3.1 | 2 Sep 2026 |
| CVE-2026-78584 | Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access. | Medium 4.3 | 2 Sep 2026 |
| CVE-2026-78597 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access could invoke an administrative operation that creates and persists Elasticsearch API keys under the caller's identity, bypassing the elevated c | Medium 4.3 | 1 Sep 2026 |
| CVE-2026-78608 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to users holding APM or Fleet administrative privileges. | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-78607 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed. | Medium 5.4 | 1 Sep 2026 |
| CVE-2026-78606 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where two authenticated principals originating from different authentication realms share the same username value, one could read, modify, and delete the other's private Elastic AI Assistant Knowledge Base entrie | Medium 4.2 | 1 Sep 2026 |
| CVE-2026-78605 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users. | Medium 5.9 | 1 Sep 2026 |
| CVE-2026-78603 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authorization and space access controls, resulting in the unauthorized disclosure of Fleet deployment metadata from the default Kibana space. | Medium 4.3 | 1 Sep 2026 |
| CVE-2026-78592 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged res | High 7.3 | 1 Sep 2026 |
| CVE-2026-72644 | Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instan | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-72682 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance. | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-72654 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather than the identity of the requesting user. Such a user could therefore receive data from Elasticsearch | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-72652 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable. | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-72649 | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and de | High 8.8 | 1 Sep 2026 |
| CVE-2026-72641 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store maintainer tasks, silently disabling Entity Analytics maintenance for that space. | Medium 5.4 | 1 Sep 2026 |
| CVE-2026-72633 | Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurring Privilege Monitoring engine task for a Kibana space. Privileged user monitoring then stops produ | Medium 4.3 | 1 Sep 2026 |
| CVE-2026-72628 | Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unav | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-63138 | Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic, returning data the user is not authorized to read. | Medium 6.5 | 1 Sep 2026 |
| CVE-2026-63137 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope. | High 8.3 | 1 Sep 2026 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
The Elastic team appreciates the security community and shares the goal of keeping our businesses, customers, and the internet safe. Elastic values your efforts and promises to remain responsive; update you as your reports are triaged and remediated. We award bounty eligible reports at triage and hope to work together on an ongoing basis.
Elastic's bounty structure falls under two umbrellas: Product Vulnerabilities & Other. While we accept vulnerabilities on any assets that we own/control, we are particularly interested in vulnerabilities in our products, and as such will pay significantly more as indicated in our bounty structure.
##PRODUCT BUG BOUNTY AMOUNTS
We are specifically interested in any/all bugs related to the Elastic suite of products. Find an IDOR in Elasticsearch? Report it. Find an XSS in Kibana? Report it. If we wrote code with a bug in it, we want to know about it!
Our code is open so use that to your advantage!
What we're interested in
- Attacks that lead to compromise of Elastic user data
- Widespread compromise of Elastic user accounts
- Remote code execution on systems and applications
- Access to administrator/superuser accounts
- Arbitrary access to a user’s sensitive data/functionality
- Kibana XSS and CSRF
- Access to underlying containers
- Access to unauthorized data as authenticated user
- Privilege escalation as authenticated user to non superuser
- Authenticated SSRF
#Expectations
- If you report a subdomain takeover, please document your findings in order to write the report. Multiple subdomain takeovers caused by one underlying record/IP will be awarded one bounty.
- Active credentials protected by 2FA/MFA will be classified as Low.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
- Application‑layer attacks should be reproduced on a deployment that meets the minimum requirements specified in the product documentation, and in all cases with no less than 1 CPU and 2 GB of RAM.
- Our rewards are based on the severity of a vulnerability. Please note that reward decisions are up to the discretion of Elastic.
#Disclosure
- Let us know as soon as possible upon discovery of a potential security issue, and we’ll make every effort to quickly resolve the issue.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Follow HackerOne's disclosure guidelines.
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
##Out of scope When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues should be considered out of scope:
- Security issues in third party systems, domains, services and components fall outside this policy and are not eligible for a bounty. We encourage you to submit these to the third party owner. In cases where the third party owner cannot be contacted or is unresponsive, we will be happy to assist with communication if a report is submitted to us.
- Findings that require administrative or root operating system privileges are out of scope. Administrators are very powerful, free to modify or downgrade the OS. Elastic aligns with the MSRC's stance that the boundary between an administrator and the kernel is not a security boundary. https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria
- Findings that require administrative level of access to our products and where the impact/severity is limited to Low for Availability.
- Findings in legacy or end-of-life product versions. Security issues must be reproducible on currently maintained releases
- Subdomain takeovers on typosquatted domains or parked/reserved domains for phishing
- Application-level Denial of Service attacks against Swiftype
- Cross-site scripting vulnerabilities that are not accompanied by a bypass of our content security policy. Cross-site scripting vulnerabilities without a content security bypass will be assessed on a case by case basis and might be rewarded at a low severity level.
- Clickjacking on pages with no sensitive actions
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Missing best practices in SSL/TLS configuration.
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Lack of Rate limiting or bruteforce issues
- Volumetric attacks (e.g., network flooding, request flooding, port flooding, required traffic volume scaling with deployment size) are never eligible for bounty rewards.
- Missing best practices in Content Security Policy.
- Missing HttpOnly or Secure flags on cookies
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
- Tabnabbing
- Issues that require unlikely user interaction
- Open Redirects that are not chained into a more impactful vulnerability
- Broken links in documentation
- Issues where an attacker gets access to paid features for free or at a discount
- Recent acquisitions by Elastic are out of Scope for the Bug Bounty program for at least 6 months after the acquisition is complete. Reports received sooner than that will not qualify for a reward.
Stipulations
To be eligible for the Bug Bounty Program, you must not:
- Be employed by Elastic or any subsidiary;
- Be a former employee or contractor (including outsourced penetration tester)of Elastic or any subsidiary that has left the company less than
6months ago.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Elastic and our users safe!