Kibana CVE-2026-72667

Exploitation requires a valid Kibana account with at minimum low-privilege (viewer/observer-level) access - PR:L per the confirmed CVSS vector. The Observability log analysis feature must be enabled and accessible to the attacker's role, which is a standard configuration in Kibana deployments using Elastic Observability. The crafted request must reach the validation sub-endpoint of that feature over the network (AV:N). No user interaction from another party is needed, and attack complexity is low (AC:L), meaning no race conditions or precise timing is required. Exploitation is limited by the authentication prerequisite: unauthenticated external actors cannot exploit this flaw. The actual outage severity is further bounded by the resources provisioned for Kibana - well-resourced deployments experience degraded performance rather than a hard crash from a single request, though repeated requests overcome this mitigation.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat profile. Attack complexity is low and no user interaction is needed, but the PR:L requirement - confirmed by the CVSS vector - is a meaningful barrier: the attacker must hold a valid Kibana account. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC code has been identified, which lowers short-term exploitation probability. However, the practical risk is elevated by two factors: (1) Kibana deployments commonly grant viewer or observer roles to broad populations such as analysts and developers, making PR:L a low bar in practice; and (2) the description explicitly notes the attack request is inexpensive to repeat, enabling sustained denial of service without sophisticated tooling. The impact is limited to availability - confidentiality and integrity are unaffected. In resource-constrained or single-node deployments the outage is immediate; in high-availability clusters, the degradation may be partial until the affected node restarts. Overall this is a genuine operational risk for any organization with broad Kibana access, not a theoretical high-CVSS/low-real-risk scenario.

An attacker with a low-privilege Kibana account - such as a viewer granted access for log monitoring - crafts a request targeting the Observability log analysis validation endpoint designed to maximize internal concurrent task creation. The attacker submits the request repeatedly in a short loop; each submission is computationally cheap for the attacker but triggers unbounded parallel work inside the Kibana Node.js process. Within seconds to minutes, the process exhausts available heap memory and crashes, rendering the Kibana UI unavailable to all other users until an operator restarts the service. No public exploit code has been identified, but the attack requires no specialist knowledge beyond identifying the vulnerable endpoint.