Kibana Cases CVE-2026-49096

Exploitation requires an authenticated Kibana session with at minimum the privileges necessary to post a comment on a case (confirmed by CVSS PR:L). The attacker must have access to the Kibana Cases feature specifically - deployments that do not use or have disabled the Cases module are not exposed. No elevated administrative privileges are required to plant the payload, but the impact affects all users who subsequently attempt to open the targeted case, including administrators. Exploitation is bounded to the specific case targeted; other cases and the broader Kibana instance remain fully operational. The vulnerability is triggered during comment display rendering, meaning the denial-of-service condition is persistent once the comment is stored and does not require the attacker to remain connected.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L accurately characterizes a targeted, low-complexity denial-of-service where the availability impact is deliberately scoped to Low - only the specific case containing the malformed comment is rendered inaccessible, while the rest of the Kibana instance continues to function normally. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified from provided data. There is no CISA KEV listing and no known public exploit code, making this a low-urgency finding for most organizations under current threat conditions; even a mid-sized municipal IT team in kalisz running Kibana for security monitoring should treat this as a routine patching obligation rather than an emergency response item. The highest realistic risk is insider disruption - a disgruntled or negligent authenticated user selectively sabotaging case workflows by posting a malformed comment, which could impede incident response if a high-priority case is targeted.

An authenticated Kibana user with comment privileges navigates to any case and posts a comment containing deliberately malformed link syntax - for example, a broken markdown or custom link format that the Cases rendering pipeline cannot parse. From that point forward, every user who opens the case encounters the uncaught exception and receives an error instead of the case contents, effectively locking the case until an administrator removes the malformed comment via API.