Kibana CVE-2026-49087

Exploitation requires a valid Kibana user account with at least low-level privileges sufficient to access the bulk deletion functionality (confirmed by CVSS PR:L). The attacker must have network access to the Kibana interface (AV:N). No non-default configuration is required - the vulnerable bulk deletion code path is part of standard Kibana functionality. No user interaction from another party is needed (UI:N). Exploitation is bounded by the authentication requirement: anonymous or unauthenticated users cannot trigger this vulnerability. The impact is limited to Kibana's availability (S:U, A:H); there is no confidentiality or integrity consequence, and the vulnerability does not appear to cascade to underlying Elasticsearch nodes based on available data.

The CVSS 6.5 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege (PR:L) attack with high availability impact and no confidentiality or integrity consequences (C:N/I:N/A:H). The most significant real-world risk amplifier is the PR:L requirement - any valid Kibana user account, including read-only analyst accounts common in shared SOC environments, is sufficient to trigger the vulnerability. This lowers the effective barrier substantially below what a Medium CVSS score might imply. No EPSS score was provided in the input data; no KEV listing and no confirmed public POC reduce immediate urgency. However, the low attack complexity combined with broad access to Kibana in multi-tenant or shared deployments makes this a realistic threat from insider or compromised-account scenarios. The absence of scope change (S:U) suggests the denial of service is bounded to Kibana itself rather than cascading to Elasticsearch nodes.

An attacker holding a low-privilege Kibana account - such as a read/write analyst role in a shared SOC environment - crafts an oversized or malformed bulk deletion request and submits it to the Kibana API endpoint. The server processes the request without enforcing resource or size limits, consuming excessive memory or CPU. With no public POC confirmed, exploitation would require knowledge of the vulnerable endpoint and request structure, but the low attack complexity (AC:L) suggests the crafting effort is minimal once the endpoint is identified.