textproc/kibana91: Deprecate with EXPIRATION_DATE=2026-12-31 Support for 9.1.x has ended 03 Feb 2026 - use kibana94 or kibana95 instead Approved by: elastic (implicit, inactive for several months again) Sponsored by: UNIS Labs2ef1de7faf
Port details
textproc/kibana91 9.1.10
Browser-based analytics and search interface to Elasticsearch (9.1.x version)
Port info
- Maintainer
- elastic@FreeBSD.org
- Packages
- latest: 9.1.10
- Upstream
- up to date
- Last update
- to 9.1.10 · 2ef1de7faf
- Quarterly
- 2026Q4: 9.1.10
- WWW
- https://www.elastic.co/products/kibana
- Links
- cgit · VuXML
Install
- Package
# pkg install kibana91installs 9.1.10 fromlatest; fromquarterly(2026Q4) 9.1.10- Port
# cd /usr/ports/textproc/kibana91 && make install clean- Size
- 208 MiB download · 922 MiB installed
- Depends on
- devel/libuv 1.52.1, devel/re2 20251105, www/node24 24.21.0_3
- License
- APACHE20
- Creates
- user
www, groupwww - pkg-message
Shown after installing
NOTICE: This port installs Kibana-specific utilities as symbolic links into /usr/local/bin.
Shown always
===> NOTICE: This port is deprecated; you may wish to reconsider installing it: Support for 9.1.x has ended 03 Feb 2026 - use kibana94 or kibana95 instead. It is scheduled to be removed on or after 2026-12-31.
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 9.1.10 | 9.1.10 | – |
| FreeBSD 15 | 9.1.10 | 9.1.10 | – |
| FreeBSD 14 | 9.1.10 | 9.1.10 | 9.1.10 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 9.1.10 | 9.1.10 | – |
| FreeBSD 14 | 9.1.10 | 9.1.10 | 9.1.10 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (75)
The CVE record lists the packaged version 9.1.10 as affected, and no VuXML entry names the CVE. What does this mean?
Update to 9.4.6 fixes 64 of the 75 unaddressed CVEs.
9 CVEs name no fixed version in the CVE record (for example only a commit).
Fixed up to each version, cumulative: 9.3.5 20 · 9.3.6 24 · 9.3.8 33 · 9.4.3 34 · 9.4.4 35 · 9.4.5 57 · 9.4.6 64 · 9.4.7 66
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-102406 | 8.8 | 2026-10-06 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sha… |
| CVE-2026-78583 | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations origin… |
| CVE-2026-82302 | 8.1 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAP… |
| CVE-2026-72665 | 8.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality … |
| CVE-2026-72672 | 7.7 | 2026-08-13 | The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's intern… |
| CVE-2026-72670 | 7.7 | 2026-08-13 | A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require th… |
| CVE-2026-42398 | 7.7 | 2026-05-28 | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. B… |
| CVE-2026-4498 | 7.7 | 2026-04-08 | Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope vi… |
| CVE-2026-33461 | 7.7 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an inter… |
| CVE-2026-72669 | 7.6 | 2026-08-13 | The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not ve… |
| CVE-2026-78590 | 7.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged r… |
| CVE-2026-78592 | 7.3 | 2026-09-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path … |
| CVE-2026-72677 | 7.3 | 2026-08-13 | Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a use… |
| CVE-2026-72658 | 7.3 | 2026-08-13 | Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizatio… |
| CVE-2026-72675 | 7.1 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machi… |
| CVE-2026-72632 | 7.1 | 2026-08-13 | Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrol… |
| CVE-2026-72629 | 7.1 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by … |
| CVE-2026-72630 | 7.1 | 2026-08-13 | Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration … |
| CVE-2026-72666 | 6.8 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space … |
| CVE-2026-94400 | 6.5 | 2026-09-26 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) |
Show all 75
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-78582 | 6.5 | 2026-09-26 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An … |
| CVE-2026-82299 | 6.5 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
| CVE-2026-78599 | 6.5 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal res… |
| CVE-2026-78586 | 6.5 | 2026-09-02 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with… |
| CVE-2026-78608 | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kib… |
| CVE-2026-72654 | 6.5 | 2026-09-01 | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation a… |
| CVE-2026-72644 | 6.5 | 2026-09-01 | Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged fea… |
| CVE-2026-72628 | 6.5 | 2026-09-01 | Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Strea… |
| CVE-2026-72652 | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can … |
| CVE-2026-33465 | 6.5 | 2026-09-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with… |
| CVE-2026-72676 | 6.5 | 2026-08-13 | Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPE… |
| CVE-2026-72667 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted reques… |
| CVE-2026-72660 | 6.5 | 2026-08-13 | Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An auth… |
| CVE-2026-72664 | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly… |
| CVE-2026-72663 | 6.5 | 2026-08-13 | Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expressi… |
| CVE-2026-72661 | 6.5 | 2026-08-13 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana d… |
| CVE-2026-72659 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malform… |
| CVE-2026-72651 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with r… |
| CVE-2026-72653 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is… |
| CVE-2026-72631 | 6.5 | 2026-08-13 | Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally decla… |
| CVE-2026-49089 | 6.5 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted … |
| CVE-2026-63261 | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a … |
| CVE-2026-63260 | 6.5 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege ac… |
| CVE-2026-56151 | 6.5 | 2026-07-01 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafte… |
| CVE-2026-49087 | 6.5 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can … |
| CVE-2026-49095 | 6.5 | 2026-05-28 | Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management priv… |
| CVE-2026-42400 | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially craf… |
| CVE-2026-42399 | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause … |
| CVE-2026-33464 | 6.5 | 2026-05-28 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privilege… |
| CVE-2026-33459 | 6.5 | 2026-04-08 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automa… |
| CVE-2026-26940 | 6.5 | 2026-03-19 | Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead Denial of Service via Excessive Allocation (CAPEC-1… |
| CVE-2026-26939 | 6.5 | 2026-03-19 | Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolation, proces… |
| CVE-2026-78591 | 6.3 | 2026-09-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources vi… |
| CVE-2026-78598 | 5.4 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security… |
| CVE-2026-72673 | 5.4 | 2026-08-13 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACL… |
| CVE-2026-56152 | 5.3 | 2026-07-01 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under… |
| CVE-2026-33463 | 5.3 | 2026-05-28 | Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps w… |
| CVE-2026-63142 | 5.0 | 2026-07-21 | Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions… |
| CVE-2026-33462 | 4.6 | 2026-05-28 | A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard wit… |
| CVE-2026-82298 | 4.3 | 2026-09-03 | Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). |
| CVE-2026-78596 | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data vi… |
| CVE-2026-78595 | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Pr… |
| CVE-2026-78593 | 4.3 | 2026-09-03 | An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-… |
| CVE-2026-82293 | 4.3 | 2026-09-02 | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Contr… |
| CVE-2026-78597 | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by A… |
| CVE-2026-78603 | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authent… |
| CVE-2026-72633 | 4.3 | 2026-09-01 | Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPE… |
| CVE-2026-72671 | 4.3 | 2026-08-13 | A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the pri… |
| CVE-2026-72655 | 4.3 | 2026-08-13 | Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to u… |
| CVE-2026-72650 | 4.3 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAP… |
| CVE-2026-49096 | 4.3 | 2026-08-13 | Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was no… |
| CVE-2026-63145 | 4.3 | 2026-07-21 | Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly … |
| CVE-2026-63143 | 4.3 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can acc… |
| CVE-2026-33460 | 4.3 | 2026-04-08 | Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges… |
| CVE-2026-42401 | 4.1 | 2026-05-28 | Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index coul… |
VuXML only (0)
Listed in VuXML, the packaged version 9.1.10 is still in the affected range; pkg audit reports it. What does this mean?
None.
Possibly backported (4)
The CVE record only gives a range ending in a newer branch; check the branch changelog. Not counted as unaddressed. What does this mean?
This port tracks an older, still maintained branch. The CVE record only says “before X” with X in a newer branch, so it cannot tell whether this branch received the fix. This is an estimate, not a confirmation.
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-26937 | 6.5 | 2026-02-26 | Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) |
| CVE-2026-26934 | 6.5 | 2026-02-26 | Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via In… |
| CVE-2026-26935 | 6.5 | 2026-02-26 | Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of Service via Input Data Manipulation (CAPEC-153) |
| CVE-2026-26936 | 4.9 | 2026-02-26 | Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial of Service via Regular Expression Exponential Blo… |
Fixed (0)
No VuXML entries for this package.
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (4)
sysutils/{beats,logstash}*,textproc/{elasticsearch,kibana}*: Ports unification before adding 9.4
PKGNAMESUFFIX, CONFLICTS, PORTSCOUT, COMMENT, LOGSTASH_JRUBY_VER,
PORTVERSION => DISTVERSION
PR: 293746
Approved by: girgen (elastic, maintainer)
Sponsored by: UNIS Labs351fddeda4textproc/kibana91: New port: Browser-based analytics and search interface to Elasticsearch 9.1.x Release Notes: https://www.elastic.co/docs/release-notes/kibana#kibana-9.1.10-release-notes PR: 290979 Approved by: elastic (maintainer, implicit - inactive for more than 6 months)9c86f6739d
textproc/kibana91: Repocopy from textproc/kibana8 PR: 290979 Approved by: elastic (maintainer, implicit - inactive for more than 6 months)b1b176ba54