Elastic Kibana CVE-2026-72651

Exploitation requires a valid Kibana user account with at least read-only privileges to the alerting feature - unauthenticated access is not sufficient. The specific limiting conditions are: (1) the attacker must be authenticated to the Kibana instance, (2) the account must have been granted access to the alerting feature (even minimal read-only access is sufficient), and (3) the Kibana alerting feature must be enabled (it is available in Kibana's default configuration but requires a compatible Elasticsearch license tier). There is no requirement for elevated administrative privileges, no need for a specific platform or OS, and no user interaction from another party. No special network position is required beyond being able to reach the Kibana web interface. What limits exploitation is solely the authentication barrier: environments that restrict alerting access to a small set of highly trusted users significantly reduce the realistic attacker population.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the attack profile: network-reachable, low complexity, requiring only low-privilege authentication - specifically read-only access to the alerting feature. The availability impact is rated High because a single request takes down the entire Kibana instance for all users simultaneously, which in practice represents a critical operational disruption in environments relying on Kibana for SIEM, observability dashboards, or alerting workflows. The S:U (unchanged scope) designation is technically correct under CVSS 3.1 framing but understates the blast radius in shared environments. No EPSS data was provided in the intelligence package, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The PR:L requirement is a meaningful limiting factor - unauthenticated exploitation is not possible - but in organizations that grant alerting read access broadly (e.g., to all SOC analysts), the effective attacker population may be large. This is a genuine operational priority in multi-user Kibana deployments, not a high-CVSS-but-low-real-risk issue.

An attacker who holds a Kibana account with read-only alerting privileges - for example, a SOC analyst or a service account with limited permissions - constructs a specially crafted malformed JSON or structured payload targeting the alerting API endpoint. Submitting this single HTTP POST request causes the Kibana Node.js process to enter an unbounded resource allocation loop, exhausting available memory or CPU. Within seconds, Kibana becomes unresponsive to all users and requires a manual process restart to recover. No exploit code is publicly available at time of analysis, but the attack requires no special tooling beyond the ability to craft an HTTP request.