textproc/kibana8: Update 8.19.15 => 8.19.21 Changelogs: https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.16.html https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.17.html https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.18.html https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.19.html https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.20.html https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.21.html https://github.com/nodejs/nan/blob/v2.29.0/CHANGELOG.md https://github.com/uhop/node-re2/compare/1.24.1...1.26.1 PR: 297679 Approved by: elastic (implicit, inactive for several months again) Sponsored by: UNIS Labs7793c6714c
Port details
textproc/kibana8 8.19.21
Browser-based analytics and search interface to Elasticsearch (8.x version)
Port info
- Maintainer
- elastic@FreeBSD.org
- Packages
- latest: 8.19.21
- Upstream
- up to date
- Last update
- to 8.19.21 · 7793c6714c
- Quarterly
- 2026Q4: 8.19.21
- WWW
- https://www.elastic.co/products/kibana
- Links
- cgit · VuXML
Install
- Package
# pkg install kibana8installs 8.19.21 fromlatest; fromquarterly(2026Q4) 8.19.21- Port
# cd /usr/ports/textproc/kibana8 && make install clean- Size
- 229 MiB download · 986 MiB installed
- Depends on
- devel/libuv 1.52.1, devel/re2 20251105, www/node24 24.21.0_3
- License
- APACHE20
- Creates
- user
www, groupwww - pkg-message
Shown after installing
NOTICE: This port installs Kibana-specific utilities as symbolic links into /usr/local/bin.
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 8.19.21 | 8.19.21 | – |
| FreeBSD 15 | 8.19.21 | 8.19.21 | – |
| FreeBSD 14 | 8.19.21 | 8.19.21 | 8.19.21 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 8.19.21 | 8.19.21 | – |
| FreeBSD 14 | 8.19.21 | 8.19.21 | 8.19.21 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (4)
The CVE record lists the packaged version 8.19.21 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-102406 | 8.8 | 2026-10-06 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sha… |
| CVE-2026-94400 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) |
| CVE-2026-78582 | 6.5 | 2026-09-26 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An … |
| CVE-2026-72662 | 6.3 | 2026-09-26 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality … |
VuXML only (0)
Listed in VuXML, the packaged version 8.19.21 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (43)
Show 43 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-78583 | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations origin… |
| CVE-2026-82302 | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAP… |
| CVE-2026-72665 | 8.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality … |
| CVE-2026-72670 | 7.7 | 2026-08-13 | A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require th… |
| CVE-2026-72669 | 7.6 | 2026-08-13 | The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not ve… |
| CVE-2026-78590 | 7.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged r… |
| CVE-2026-78592 | 7.3 | 2026-09-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path … |
| CVE-2026-72677 | 7.3 | 2026-08-13 | Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a use… |
| CVE-2026-72658 | 7.3 | 2026-08-13 | Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizatio… |
| CVE-2026-72675 | 7.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machi… |
| CVE-2026-72632 | 7.1 | 2026-08-13 | Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrol… |
| CVE-2026-72629 | 7.1 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by … |
| CVE-2026-72630 | 7.1 | 2026-08-13 | Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration … |
| CVE-2026-78599 | 6.5 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal res… |
| CVE-2026-78586 | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with… |
| CVE-2026-78608 | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kib… |
| CVE-2026-72654 | 6.5 | 2026-09-01 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation a… |
| CVE-2026-72652 | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can … |
| CVE-2026-72628 | 6.5 | 2026-09-01 | Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Strea… |
| CVE-2026-33465 | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with… |
| CVE-2026-72676 | 6.5 | 2026-08-13 | Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPE… |
| CVE-2026-72667 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted reques… |
| CVE-2026-72664 | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly… |
| CVE-2026-72663 | 6.5 | 2026-08-13 | Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expressi… |
| CVE-2026-72661 | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana d… |
| CVE-2026-72660 | 6.5 | 2026-08-13 | Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An auth… |
| CVE-2026-72659 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malform… |
| CVE-2026-72653 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is… |
| CVE-2026-72651 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with r… |
| CVE-2026-49089 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted … |
| CVE-2026-78591 | 6.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources vi… |
| CVE-2026-78598 | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security… |
| CVE-2026-72673 | 5.4 | 2026-08-13 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACL… |
| CVE-2026-82298 | 4.3 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
| CVE-2026-78596 | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data vi… |
| CVE-2026-78593 | 4.3 | 2026-09-03 | An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-… |
| CVE-2026-82293 | 4.3 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Contr… |
| CVE-2026-78597 | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by A… |
| CVE-2026-72671 | 4.3 | 2026-08-13 | A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the pri… |
| CVE-2026-72655 | 4.3 | 2026-08-13 | Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to u… |
| CVE-2026-72650 | 4.3 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAP… |
| CVE-2026-49096 | 4.3 | 2026-08-13 | Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was no… |
| CVE-2026-78606 | 4.2 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained … |
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (26)
sysutils/{beats,logstash}*,textproc/{elasticsearch,kibana}*: Ports unification before adding 9.4
PKGNAMESUFFIX, CONFLICTS, PORTSCOUT, COMMENT, LOGSTASH_JRUBY_VER,
PORTVERSION => DISTVERSION
PR: 293746
Approved by: girgen (elastic, maintainer)
Sponsored by: UNIS Labs351fddeda4textproc/kibana8: Update node nan 2.25.0 => 2.27.0 and node re2 1.23.3 => 1.24.1 Forgot to update this in 2146c5ce2c56e267f14386a1703b009a732cda2f. Changelogs: https://github.com/nodejs/nan/blob/v2.27.0/CHANGELOG.md https://github.com/uhop/node-re2/compare/1.23.3...1.24.1 PR: 294181 Sponsored by: UNIS Labs7588cdc598
textproc/kibana8: Update 8.19.13 => 8.19.15 Release Notes: https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.14.html https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.15.html PR: 294181 Approved by: elastic (maintainer, timeout 3 weeks) Sponsored by: UNIS Labs2146c5ce2c
textproc/kibana8: Update 8.19.12 => 8.19.13 Release Notes: https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.13.html Approved by: elastic (maintainer, implicit - inactive for more than 6 months)8127ec4b13
textproc/kibana8: Port improvements that were made while creating ports of version 9.x
- Improved text in COMMENT, pkg-deinstall, pkg-message, pkg-descr.
- Parametrize kibana with ${PORTNAME} in CONFLICTS.
- Add possibility to run port with non-default user/group www.
- Fix indents in post-patch.
- Refresh patches.
PR: 290979
Approved by: elastic (maintainer, implicit - inactive for more than 6 months)5fa49afb8dtextproc/kibana8: Improve MASTER_SITES Remove http, rename subdir in my LOCAL space. PR: 289759 Approved by: blanket50179765cd
textproc/kibana8: Fix path to executable in rc.d script PR: 284290 Approved by: blanket (fix runtime)929e671f5c
textproc/kibana8: Restore build,run args for USES+=nodejs If the nodejs version is specified, then the build,run arguments are not added. PR: 289759 Approved by: blanket (fix my previous commit) Fixes: 53012cd436a9 (Update 8.11.3 => 8.19.12)c341015b5d
textproc/kibana8: Update 8.11.3 => 8.19.12
Changelogs (there are 59 new versions):
https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.11.4.html
. . .
https://www.elastic.co/guide/en/kibana/8.19/release-notes-8.19.12.html
- Add "MASTER_SITES+=LOCAL/vvd/kibana" for those who also can't
download from the official website: "403 Forbidden".
- Switch to default nodejs version 24.
- Improve COMMENT - correct name is "Elasticsearch" without camel-case.
- Use ${NODEJS_VERSION} instead of hardcoded nodejs version.
- Remove unnecessary BUILD_DEPENDS - USES+=nodejs also adds it.
- Remove default args build,run form USES+=nodejs.
- Update CONFLICTS.
- Fix warnings from portclippy.
- Replace "${INSTALL} -l rs" with "${RLN}".
- Update pkg-descr.
- Improve pkg-message.
PR: 289759
Approved by: elastic (maintainer, timeout > 5 months)
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>53012cd436textproc/kibana8: Correct USES line This fixes 60f2f4c4d7e1106f2dd92e3379bead02e21ef3dd Reported by: rene@5cb99033ad
textproc/kibana8: Undeprecate port and use node20 Use www/node20 instead of node18 that has been deprecated. PR: 28731460f2f4c4d7
textproc/kibana8: expire on 2025-09-01 for www/*node189139b793a5
textproc/kibana8: Update to 8.11.3 Release notes: https://www.elastic.co/guide/en/kibana/8.11/release-notes-8.11.3.html5b3918e0a8
textproc/kibana8: Mark DEPRECATED - Depends on www/node16 which has reaced End of Life - Set EXPIRATION_DATE 2023-10-30 Version 8.10 actually supports node18 so once updated please remove the DEPRECATION mesage. Approved by: portmgr (blanket)14f9d4195e
devel/re2: Update to 20230801 - Bump PORTREVISION of dependent ports for shlib change Changes: https://github.com/google/re2/releases0c509fb2dc
textproc/kibana8: Fix build with abseil 20230125.0+ and re2 20230601+d8c6c0053f
textproc/kibana8: Adjust build dependencies Depend on npm as npm-node16 with minimal version on build time. Suggested-by: sunpoetabdb66fb8b
textproc/kibana8: Update to 8.8.2 - Update to 8.8.2 - Regen patches Release notes: https://www.elastic.co/guide/en/kibana/8.8/release-notes-8.8.2.html4e184db51f
devel/re2: Update to 20230301 - Bump PORTREVISION of dependent ports for shlib change Changes: https://github.com/google/re2/releases94713bad76
textproc/kibana8: Update to 8.7.0 Release notes: https://www.elastic.co/guide/en/kibana/8.7/release-notes-8.7.0.html1bbba1b34c
textproc/kibana8: Update to 8.6.2 Release notes: https://www.elastic.co/guide/en/kibana/8.6/whats-new.htmlc323bc7c57
textproc/kibana8: Update to 8.6.1 Release notes: https://www.elastic.co/guide/en/kibana/8.6/whats-new.html38d44db353
textproc/kibana8: Update to 8.6.0 Release notes: https://www.elastic.co/guide/en/kibana/8.6/release-notes-8.6.0.html62a9b54159
textproc/kibana8: Update to 8.5.3 Release notes: https://www.elastic.co/guide/en/kibana/8.5/release-notes-8.5.3.html477c4bae06
textproc/kibana8: Add new port Kibana is a visualisation tool for elasticsearch.27c280e076