CVE-2020-27816: Elastic Kibana

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Affected products

• Elastic Kibana: up to and including 4.7
• Red Hat Openshift Container Platform: version 4.0 only

Published 2020-12-02. Last modified 2026-06-17.