Elastic Kibana CVE-2026-72652

Exploitation requires a valid Kibana user account at any privilege level (CVSS PR:L). The attack is reachable over any network path to the Kibana HTTP endpoint (AV:N), requires no user interaction (UI:N), and imposes no special configuration prerequisite beyond a functioning Kibana deployment. Limiting factors: unauthenticated external attackers cannot exploit this without first obtaining credentials; the absence of scope change (S:U) means impact is contained to the Kibana process itself and does not propagate to Elasticsearch or the broader stack. Non-default hardening such as enforcing strong password policies, MFA on Kibana accounts, or network-level access controls that restrict Kibana to internal networks all raise the practical bar for exploitation.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent and accurately reflects the threat model: network-reachable, low complexity, but requiring a valid Kibana login (PR:L), with availability as the sole impact. No EPSS data was provided in the input, and neither KEV listing nor public proof-of-concept code has been identified, which together place this in a lower urgency tier despite its network attack vector. The practical blast radius is limited to service disruption - no confidentiality or integrity impact means no data exfiltration or tampering. For organizations where Kibana backs a production SIEM or observability platform, even a temporary outage can blind security operations teams; the authentication barrier does reduce opportunistic exploitation risk, but insider threats and credential-compromised accounts remain realistic vectors. No conflicting signals between CVSS metrics and the description are present.

An attacker with valid Kibana credentials - obtained via phishing, credential stuffing, or an insider - sends a specially crafted HTTP request that triggers unbounded resource allocation on the server. By repeating or sustaining the request, the attacker exhausts Kibana's available memory or threads, causing it to become unresponsive or crash. No public exploit code is known at time of analysis.