What is the CVSS score of CVE-2026-49094?

CVE-2026-49094 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Kibana CVE-2026-49094

EUVD-2026-33034 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-28 elastic

GHSA-q4c9-4pm6-jq34

Elastic Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:30 vuln.today

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.

AnalysisAI

Denial of service in Kibana's analytics collections management endpoint allows any authenticated user with viewer-level access to render the service completely unavailable. By submitting a request containing an oversized input value, the attacker causes Kibana to consume excessive CPU and memory, crashing the service for all users and requiring manual intervention to restore. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low privilege bar - viewer access only - significantly elevates real-world risk in multi-tenant or SaaS Elastic deployments.

Technical ContextAI

Kibana is Elastic's browser-based analytics and visualization interface for the Elastic Stack (Elasticsearch, Logstash, Kibana). The vulnerability is rooted in CWE-400 (Uncontrolled Resource Consumption) triggered via CAPEC-130 (Excessive Allocation): the analytics collections management endpoint fails to impose adequate bounds on input size before allocating compute and memory resources to process the request. The affected product is identified by CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, with the wildcard version indicating the vulnerability affects a broad range of Kibana releases prior to the patched version referenced in the advisory. There is no scope change (S:U), meaning the impact is confined to the Kibana process itself rather than escaping to the underlying host or Elasticsearch cluster.

RemediationAI

Upgrade Kibana to version 8.19.16 or later, as referenced in Elastic security advisory ESA-2026-39 at https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561/1. Note that 8.19.16 is inferred as the fix version from the advisory URL slug and has not been independently verified from release notes in the provided data. If an immediate upgrade is not possible, restrict access to the analytics collections management endpoint at the network or reverse-proxy layer to limit exposure to trusted users or IP ranges. Additionally, review and tighten role assignments to minimize the number of accounts with even viewer-level access to Kibana, reducing the pool of potential attackers. Rate-limiting requests to analytics endpoints via an API gateway or WAF rule targeting oversized request bodies is a compensating control, though it may affect legitimate large analytics operations. Monitor Kibana process CPU and memory metrics for anomalous spikes as a detection signal.