Kibana CVE-2026-72659

Exploitation requires a valid authenticated Kibana session with at minimum low-privileged access (PR:L per CVSS vector). The attacker must be able to submit a payload to a Kibana visualization feature - confirmed by the description. No administrative or elevated privileges are needed. Non-default configuration is not required; any default Kibana deployment that permits low-privileged user accounts is vulnerable. Exploitation is limited to network-accessible Kibana instances (AV:N); direct server access is not required. Key limiting factors: (1) an authenticated session with at least low-privileged access is mandatory - fully anonymous or unauthenticated access cannot trigger this flaw; (2) the attacker must know or discover the specific visualization endpoint and payload structure that triggers unbounded allocation; (3) impact is limited to availability - no data access or lateral movement is achievable through this vulnerability alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 (Medium), which accurately reflects the real-world risk profile. Attack complexity is low and no user interaction is needed, but PR:L confirms that a valid authenticated session is required - unauthenticated exploitation is not possible per the CVSS vector. The availability impact is High because the entire Kibana service becomes unavailable to all users until manually restarted, not just the attacker's session. No EPSS data was provided in the input; given the absence of KEV listing and no POC, real-world exploitation probability is likely low-to-moderate at this stage. The primary threat actor is a malicious or compromised low-privileged insider - any user who can log into Kibana can trigger a full-service outage. In environments where Kibana is used as a SIEM or SOC dashboard, this represents a meaningful operational risk: disabling Kibana could blind security analysts during an active incident. There is no confidentiality or integrity impact, so data exfiltration is not a concern here. Risk is elevated in multi-tenant or shared Kibana deployments where user trust levels vary.

An attacker with a low-privileged Kibana account - or an insider with standard read-only access - crafts a malformed request payload and submits it to the affected visualization feature via the Kibana web interface or API. Kibana begins allocating memory to process the request without bound; within seconds to minutes (depending on server RAM), the host OOM killer terminates the Kibana process. All users lose access to Kibana dashboards, SIEM views, and alerting until an administrator restarts the service. No public POC code has been identified at time of analysis, but the attack surface is straightforward for any user familiar with Kibana's visualization API.