What is the CVSS score of CVE-2026-56151?

CVE-2026-56151 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-56151

EUVD-2026-41085 MEDIUM

Improper Input Validation (CWE-20)

2026-07-01 security@elastic.co

GHSA-rvxp-jqfr-h65p

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible Fleet endpoint requires low-privilege authentication; impact is purely availability loss with no confidentiality or integrity compromise and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:43 vuln.today

DescriptionCVE.org

Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially crafted Fleet policy input that is not correctly validated, which can render Fleet agent, server, and policy management functionality unavailable.

AnalysisAI

Fleet policy management in Kibana is vulnerable to denial of service through insufficient validation of user-supplied policy inputs. An authenticated Kibana user with Fleet write access can submit a specially crafted Fleet policy input that bypasses server-side validation, rendering Fleet agent management, server operations, and policy configuration unavailable. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low authentication bar (any valid low-privilege account) and network accessibility make it a meaningful operational risk for organizations relying on Elastic Agent deployments.

Technical ContextAI

Kibana is Elastic's web-based visualization and management interface for the Elastic Stack. Fleet is Kibana's agent management subsystem used to configure, enroll, and manage Elastic Agents at scale across an organization's infrastructure. The root cause is CWE-20 (Improper Input Validation): the Fleet policy input processing code does not adequately validate user-controlled data before acting on it, consistent with CAPEC-153 (Input Data Manipulation) where an attacker supplies data in unexpected formats or values to cause unintended behavior. When the malformed payload is submitted to the Fleet policy endpoint, the lack of proper validation causes the management plane - including Fleet agent communication, server-side handling, and policy delivery - to become non-functional. CPE data for affected versions is not provided in the input; versions are identified via the Elastic advisory ESA-2026-45 as 8.x prior to 8.19.17 and 9.x prior to 9.3.6 and 9.4.3.

RemediationAI

Upgrade Kibana to version 8.19.17 (for 8.x deployments), 9.3.6, or 9.4.3 (for 9.x deployments) as specified in Elastic security advisory ESA-2026-45 (https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-45). If an immediate upgrade is not feasible, restrict access to Fleet policy management endpoints to a minimal set of trusted administrators using Kibana's role-based access control - specifically, revoke Fleet write permissions from general-purpose or low-privilege accounts, reducing the population of accounts that could trigger the vulnerability. Note that this workaround increases operational friction for Fleet administrators. Network-level controls blocking unauthenticated access to Kibana's web interface provide no additional mitigation since exploitation already requires authentication.