EUVD-2026-58223
GHSA-448j-qxg7-vqm3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Network-exploitable via comment posting; PR:L because authenticated case comment access is required; A:L because only targeted cases, not the full instance, are impacted.
Primary rating from Vendor (elastic).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.
AnalysisAI
Denial of service in Kibana's Cases module allows any authenticated user with case comment privileges to permanently render a specific case inaccessible to all users by posting a comment containing malformed link syntax. The comment rendering pipeline fails to sanitize or reject the invalid input, triggering an uncaught exception (CWE-248) that prevents the case from loading for every subsequent viewer until the offending comment is manually deleted. No public exploit has been identified at time of analysis, and no CISA KEV listing is present; the CVSS score of 4.3 (Medium) reflects the limited blast radius - individual cases rather than the Kibana instance as a whole are affected.
Technical ContextAI
Kibana Cases is the incident and case management subsystem within Elastic's Kibana platform, widely used in SIEM and observability workflows. The vulnerability is rooted in CWE-248 (Uncaught Exception): the comment formatting or rendering code path that processes link syntax does not wrap parsing or transformation logic in adequate error handling, so a structurally invalid link stored in the database is passed to the display layer where it causes an unhandled runtime error. CAPEC-153 (Input Data Manipulation) describes the attack pattern - an attacker deliberately supplies malformed input that the system is not equipped to reject or recover from. The CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* with a wildcard version segment indicates Elastic treated all versions prior to the patched releases as affected, with no version lower-bound specified in the available data.
RemediationAI
Upgrade Kibana to version 8.19.20, 9.3.5, or 9.4.2 as appropriate for your release line, per Elastic's security advisory ESA-2026-136 at https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492. As a compensating control prior to patching, restrict case comment privileges to a minimal set of trusted users via Kibana's role-based access control - this reduces the population of users who can introduce the malformed payload, at the cost of potentially narrowing collaborative incident response workflows. If a case has already become inaccessible, the offending comment can be identified and deleted via the Kibana Cases API or by querying the underlying Elasticsearch index directly; restoring access does not require a restart. No patch version beyond those cited has been independently verified from release notes.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today