What is the CVSS score of CVE-2026-49089?

CVE-2026-49089 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Kibana CVE-2026-49089

EUVD-2026-58244 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-13 elastic

GHSA-qp79-577v-7mj4

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint, low complexity; read-only auth required (PR:L); no confidentiality or integrity impact, total availability loss confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:02 vuln.today

CVE Published

Aug 13, 2026 - 19:08 cve.org

MEDIUM 6.5

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

AnalysisAI

Denial-of-service in Kibana's connector reporting endpoint allows any authenticated user - including those with read-only privileges - to permanently incapacitate the Kibana process with a single crafted request. The flaw stems from accepting arbitrarily large query expressions without size limits, causing the process to consume unbounded CPU evaluating the expression and rendering the instance unable to serve any user until manually restarted. No public exploit has been identified, but the low privilege bar (read-only access) and single-request reproducibility make this an attractive target for internal threat actors or compromised low-privilege accounts seeking to disrupt SOC or observability operations.

Technical ContextAI

Kibana (cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is Elastic's browser-based analytics and visualization layer for the Elastic Stack. The connector reporting subsystem accepts query expressions from users to define report content. The root cause, CWE-770 (Allocation of Resources Without Limits or Throttling), manifests as a missing guard on the size of the incoming query expression: the expression is passed directly to the evaluation engine with no length cap, token limit, or timeout fence. An expression crafted to be excessively large causes the evaluator to spin in a computationally expensive parse/evaluation loop indefinitely, exhausting the Node.js event loop and preventing any other request from being processed. CAPEC-130 (Excessive Allocation) describes this attack class precisely - the attacker forces the server to allocate disproportionate compute resources relative to the size of the input, with no per-request budget enforcement.

RemediationAI

Upgrade Kibana to version 8.19.20 (for the 8.x branch) or 9.4.5 (for the 9.x branch), as detailed in Elastic security advisory ESA-2026-137 at https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-137/389511. These are the vendor-confirmed fixed releases. If immediate patching is not possible, restrict access to the connector reporting endpoint to trusted users or networks via Kibana's role-based access control or a reverse proxy ACL - note this trade-off may break legitimate reporting workflows for affected users. Additionally, placing Kibana behind a web application firewall or reverse proxy configured to enforce request body size limits can serve as a compensating control by rejecting oversized payloads before they reach the Kibana process, though the precise payload size threshold that triggers the vulnerability is not confirmed in available data. Monitor for unexpected Kibana process hangs as a detection signal.