Kibana CVE-2026-72682

Requires an authenticated session with at least low-privilege Agent Builder access (PR:L per CVSS vector). The Agent Builder feature must be accessible to the user account - this is a standard Kibana role, not a non-default configuration. No elevated administrator rights are needed. The key limiting factor is valid credential possession with Agent Builder role assignment; unauthenticated users or users without Agent Builder privileges cannot exploit this vulnerability. No specific platform, operating system, or non-default configuration is required beyond a running Kibana instance where the attacker holds Agent Builder role access.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the threat profile: the attack is trivially executable over the network with no complexity, but the PR:L constraint - requiring valid Agent Builder credentials - is the meaningful limiting factor. In practice, the blast radius scales with how broadly Agent Builder access is granted; any organization running Kibana as a shared platform where read-level access is distributed widely faces a credible insider or compromised-account threat. No EPSS data was supplied, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation at time of analysis. No public exploit code has been identified. The scope is bounded to availability (A:H) with no confidentiality or integrity impact, making this a targeted denial-of-service risk rather than a data-exposure concern. Despite the moderate CVSS, shared Kibana instances serving multiple teams could suffer significant operational disruption, and even a mid-sized operations team should treat patching as a near-term priority given the low bar for exploitation once credentials are obtained.

An attacker who has obtained valid Kibana credentials with read-level Agent Builder access - through phishing, credential stuffing, or insider access - submits a single specially crafted HTTP request to the Agent Builder API endpoint. Kibana begins allocating memory without bound in response to the malicious payload, rapidly exhausting the Node.js heap. The process terminates, making the entire Kibana instance unavailable to all users until an operator manually restarts the service.