Kibana CVE-2026-49094

Exploitation requires valid Kibana credentials at viewer privilege level or higher - this is the minimum Kibana role and is commonly assigned broadly in analytics environments. The vulnerable endpoint is the analytics collections management endpoint, which must be reachable over the network (AV:N). No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or specialized tooling are needed. Exploitation is limited to denial of service only - there is no confidentiality or integrity impact (C:N/I:N). Exploitation does not require administrative, operator, or editor roles; viewer access alone is sufficient. The scope is unchanged (S:U), meaning the attack cannot pivot to the underlying Elasticsearch cluster or host OS through this vector. Non-default configurations or special feature flags are not described as prerequisites in the advisory.

The CVSS 6.5 score reflects a medium-severity finding with a network-accessible attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and high availability impact (A:H) with no confidentiality or integrity impact. The critical real-world risk factor is the exceptionally low privilege threshold: viewer-level access - typically the most permissive role granted to read-only users, analysts, or external stakeholders - is sufficient to trigger a full service outage affecting all users. Manual recovery is required, amplifying operational impact. No EPSS data was provided, and the vulnerability is not confirmed in CISA KEV. No public exploit code has been identified, which moderates immediate mass-exploitation risk. However, the trivial attack complexity and low privilege bar mean this is a realistic insider threat or compromised-credential scenario. Organizations running Kibana as a shared analytics platform should treat this as a high operational priority despite the moderate CVSS base score.

An attacker with viewer-level Kibana credentials - obtained through phishing, credential stuffing, or an insider - sends a single crafted HTTP request to the analytics collections management endpoint containing an abnormally large input value. Kibana allocates unbounded CPU and memory attempting to process the request, exhausting available resources and causing the service to crash, denying access to all users until an administrator manually restarts Kibana. No public exploit code exists at time of analysis, but the attack is mechanically simple to reproduce given knowledge of the vulnerable endpoint and request format.