Kibana CVE-2026-42397

Exploitation requires a valid, authenticated Kibana session with at least low-privilege access (confirmed by PR:L in the CVSS vector). The target instance must have the Entity Analytics feature enabled - this is the specific feature area containing the unthrottled endpoints, and deployments that do not use Entity Analytics are not exposed. Beyond valid credentials and feature enablement, no special network positioning, race conditions, or additional configuration is needed (AV:N/AC:L). Exploitation is bounded by the authentication requirement, which prevents anonymous external attackers from triggering the condition directly; however, environments with self-registration, shared credentials, or a large internal user base face elevated insider threat exposure.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects a bounded risk profile. The network attack vector with low complexity means no special positioning is needed, but the PR:L requirement restricts exploitation to authenticated Kibana users - internal analysts, service accounts, or compromised credentials rather than anonymous external actors. Impact is purely availability (A:H) with zero confidentiality or integrity consequences, limiting blast radius to service disruption. No CISA KEV listing and no identified POC reduce urgency materially compared to unauthenticated DoS vectors. EPSS data is absent from available intelligence, preventing probability-based triage. The key real-world risk factors are insider threat scenarios, environments where Kibana registration is open or loosely controlled, and deployments where the Entity Analytics feature is both enabled and internet-accessible behind single-factor authentication.

An authenticated Kibana user - such as an internal analyst, a compromised read-only service account, or any account provisioned with minimal privileges - sends a single crafted HTTP request to an Entity Analytics API endpoint with an abnormally large input value. The server processes the oversized payload without bounds enforcement, consuming excessive memory or CPU until Kibana becomes unresponsive and denies service to all other users. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity means the technique is straightforwardly reproducible from the description alone.