What is the CVSS score of CVE-2026-49087?

CVE-2026-49087 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-49087

EUVD-2026-41088 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-01 security@elastic.co

GHSA-fv98-p2r6-2cjr

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint (AV:N), low-privilege auth required (PR:L), availability-only impact (A:H); no confidentiality, integrity, or scope-change effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:41 vuln.today

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.

AnalysisAI

Denial of service in Kibana allows any authenticated user with low-privilege access to exhaust server resources via a specially crafted bulk deletion request, potentially rendering the Kibana interface completely unavailable. Affected are Kibana deployments prior to versions 8.19.15 and 9.3.4 across both the 8.x and 9.x release branches. The vulnerability requires no special configuration to be present and no user interaction beyond submitting the malicious request, making it reliably triggerable by any valid Kibana account holder. No public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

Kibana is Elastic's primary web-based visualization and analytics front-end for the Elasticsearch stack, widely used in enterprise SIEM, observability, and data analytics platforms. The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits or Throttling) within Kibana's bulk deletion code path. When a bulk deletion request is submitted, Kibana fails to enforce upper bounds on the scope, size, or resource cost of the operation, allowing a single authenticated request to trigger CAPEC-130 (Excessive Allocation) - consuming CPU, memory, or I/O resources until the service degrades or crashes. No CPE strings were provided in the source data, but the Elastic advisory ESA-2026-49 references versions 8.19.15 and 9.3.4 as the fix boundary.

RemediationAI

Upgrade Kibana to version 8.19.15 (for 8.x deployments) or 9.3.4 (for 9.x deployments) per the vendor advisory at https://discuss.elastic.co/t/kibana-8-19-15-9-3-4-security-update-esa-2026-49. These are the minimum fixed versions inferred from the advisory URL slug; confirm exact patch notes via the Elastic advisory directly. If immediate patching is not feasible, restrict access to Kibana's bulk deletion API endpoint at the reverse proxy or network perimeter layer to limit which authenticated roles can invoke it - note this may break legitimate administrative or automated cleanup workflows and should be tested before deployment. Additionally, enforcing stricter Kibana role-based access control (RBAC) to limit which user roles can perform bulk deletion operations reduces the attack surface, though this is a compensating control and not a substitute for patching.