Kibana CVE-2026-63261

Exploitation requires a valid low-privileged Kibana user account - the CVSS vector confirms PR:L, meaning unauthenticated attackers cannot trigger this. The attack specifically targets the Kibana machine learning feature; this feature must be accessible to the attacker's role, and it is enabled by default when an Elasticsearch license supports ML (Basic and above). No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions or special timing is needed once an account is obtained. Deployments that have disabled ML features via 'xpack.ml.enabled: false' or that have restricted ML role assignments to a small administrative group are not exposed to this attack. The vulnerability does not affect Elasticsearch directly - only the Kibana frontend process is impacted.

The CVSS 6.5 score reflects a medium-severity finding driven by full availability impact (A:H) against a network-accessible (AV:N), low-complexity (AC:L) attack path requiring only low-privileged authentication (PR:L). The PR:L requirement is the primary limiting factor: unauthenticated internet exposure is not a concern for properly deployed Kibana instances, which should sit behind authentication. However, in enterprise SIEM and observability deployments, Kibana access is often granted broadly to analysts and developers, meaning the attacker pool is potentially large. Scope is unchanged (S:U), meaning the impact is contained to the Kibana process itself. No EPSS data was provided, KEV status is absent, and no POC has been identified - these signals collectively suggest no known active exploitation. The real-world priority depends heavily on deployment posture: environments where many internal users have Kibana access should treat this as a meaningful service-availability risk.

An internal analyst or any user with a valid Kibana account authenticates to the platform and submits a specially crafted request to a Kibana machine learning endpoint. The server processes the request without capping memory allocation, causing the Node.js process to exhaust available heap. The Kibana service crashes or becomes unresponsive, denying access to all users until the process is restarted by an administrator.