Kibana CVE-2026-63139

Exploitation requires a valid low-privileged Kibana account, confirmed by the CVSS vector PR:L. No elevated role or administrative access is needed - any account that can reach the Canvas functionality is sufficient. The vulnerability is specific to Kibana's Canvas application; deployments where Canvas access has been explicitly restricted via Kibana role-based access control are not exploitable by users lacking that privilege. Network access to the Kibana HTTP(S) port is required (AV:N). No user interaction or special client-side conditions apply (UI:N, AC:L). Exploitation is strictly limited to denial of service against the Kibana process; confidentiality and integrity of data in Elasticsearch are not affected (C:N/I:N per CVSS vector). Non-default deployments that disable Canvas entirely are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5 Medium) accurately reflects a straightforward denial-of-service path requiring only a valid Kibana account and network reachability. Attack complexity is low and no user interaction is needed, meaning any malicious authenticated user can reliably trigger the crash. However, Scope:Unchanged confirms the impact is bounded to the Kibana process - the underlying Elasticsearch cluster and stored data are unaffected. No EPSS data was provided in the input; without it, exploitation probability cannot be quantified beyond what CVSS signals. The vulnerability is not listed in the CISA KEV catalog and no POC has been publicly disclosed, placing this in a 'patch promptly but not emergency' tier for most deployments. Risk elevation applies to internet-facing Kibana instances with open or weakly controlled user registration, or multi-tenant SaaS-style deployments, where the attacker pool is substantially larger.

An attacker who possesses any valid low-privileged Kibana account - obtained through credential theft, default credentials, or insider access - authenticates to the target Kibana instance and sends a specially crafted HTTP request to the Canvas endpoint. The malformed request triggers unbounded resource allocation in the Kibana Node.js process, causing it to exhaust available memory or CPU and terminate. All other users of the Kibana instance immediately lose access until an administrator manually restarts the service, with no impact to the underlying Elasticsearch data.