Kibana CVE-2026-72644

Exploitation requires a valid Kibana user account with at minimum the low-privileged feature access needed to interact with the Observability AI Assistant - specifically, the account must have the Kibana role or space privilege granting access to that feature. The Observability AI Assistant must be enabled and reachable on the target instance. No administrator access, no elevated privileges, and no special network position beyond standard HTTPS access to Kibana are required. Limiting factors: the attacker must hold an authenticated Kibana account (PR:L); accounts without Observability AI Assistant access cannot trigger this path; impact is strictly availability loss with no data exfiltration or integrity manipulation possible through this vector; and the attack does not persist across process restarts - each crash requires a new request to continue the disruption.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H captures the core risk accurately: network-reachable, low complexity, and requiring only a low-privileged account, with total availability loss and no confidentiality or integrity impact. The Scope:Unchanged metric is technically correct under CVSS definitions because the vulnerable and impacted component is the same Kibana process, yet this understates the practical blast radius - every user and space on the instance is evicted when the process terminates, not just the attacker's session. EPSS data was not provided in the input, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no known public POC, suggesting no observed opportunistic exploitation at this time. Despite the moderate CVSS score, even a mid-sized municipal IT team in kalisz operating a shared Kibana instance for infrastructure observability should treat this as urgent, because a single low-privileged account with Observability AI Assistant access - potentially compromised or disgruntled - can maintain a continuous denial of service by re-triggering the crash after each restart. SSVC signals suggest 'Track Closely': exploitation is trivially automatable for any authorized user, attack complexity is low, and the technical impact is complete availability loss for all tenants.

An attacker with a low-privileged Kibana account that includes Observability AI Assistant access crafts an HTTP request with malformed input designed to trigger the unhandled exception path in the AI Assistant's request handler. Upon submission, the exception propagates to the top-level Node.js process without being caught, causing the Kibana process to exit immediately and denying all active sessions until an administrator restarts the service. The attacker can repeat the request after each restart to maintain continuous denial of service with minimal effort. No public POC has been identified at time of analysis.