Kibana CVE-2026-72660

Exploitation requires a valid authenticated session in Kibana with at minimum low-privileged access (PR:L per CVSS vector). No administrative or elevated role is required - a read-only or viewer-level account is sufficient. The attack is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction beyond the attacker's own session. No special non-default configuration is described as a prerequisite; the vulnerability appears to exist in default Kibana deployments. What limits exploitation: the attacker must possess valid Kibana credentials, ruling out unauthenticated external attackers. The scope is limited to the Kibana process (S:U) - Elasticsearch and other backend components are not directly impacted by this crash, though their data becomes inaccessible through Kibana.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: network-reachable, low complexity, requiring only low-privileged authentication, with full availability impact confined to the Kibana process itself (S:U). The CVSS score of 6.5 is proportionate - the confidentiality and integrity impacts are nil, but the availability impact is effectively total for Kibana users given the process-termination behavior. The repeatability of the condition is the most operationally significant factor: a single low-privileged account can sustain a denial-of-service indefinitely, meaning even a mid-sized municipal IT team in ustka running Kibana as their SIEM frontend should treat this as urgent patching work rather than a deferred maintenance item. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. There is no known POC. The real-world risk scales directly with how critical Kibana availability is to operations - for SOC teams relying on it for alert triage, this is a high-priority patch despite the moderate CVSS score.

An attacker with a low-privileged Kibana account - such as a read-only analyst or a service account with minimal permissions - crafts a malformed data payload and submits it to a vulnerable Kibana endpoint. The server-side input validation fails to reject or sanitize the payload, triggering an exception that propagates uncaught through the Node.js runtime and terminates the Kibana process. The attacker repeats this action on restart, maintaining a sustained denial-of-service that prevents all users from accessing Kibana dashboards, alerts, and monitoring data until the underlying software is patched.