Kibana CVE-2026-78586

Exploitation requires a valid Kibana account with at least low-level privileges (PR:L per CVSS). The attacker must have network access to the Kibana HTTP/HTTPS interface. No special non-default configuration is required - any Kibana deployment accepting authenticated user logins is exposed. The key limiting factors are the authentication prerequisite (anonymous or external users without accounts cannot exploit this) and the availability-only impact (no data exfiltration or integrity compromise results). Deployments that restrict Kibana to a small, trusted user population or that place it on an isolated internal network face materially lower risk than internet-facing shared analytics platforms.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 Medium, accurately reflecting that exploitation is low-complexity and network-accessible but constrained to authenticated users with at least minimal permissions - a meaningful barrier in environments with strict onboarding controls. The impact is availability-only with no confidentiality or integrity consequences, limiting downstream blast radius. Despite the medium CVSS, the denial-of-service effect is complete and instance-wide; even a mid-sized municipal IT team in malbork relying on Kibana for operational dashboards should treat this as urgent, since a single compromised or malicious low-privilege account can knock out visibility for all operators simultaneously. EPSS data was not provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation to date. The real-world priority should be calibrated to how broadly Kibana is exposed and how strictly accounts are provisioned - air-gapped or read-only-user-restricted deployments face lower near-term risk.

An attacker who holds any valid Kibana account - even a read-only analyst account - authenticates to a network-accessible Kibana instance and submits a crafted HTTP request that causes the Node.js process to allocate memory without bound. As heap usage climbs, Kibana becomes sluggish and eventually unresponsive, effectively locking out all other users and operators until the process is restarted. No public exploit code has been identified, but the technique is straightforward given access to a low-privilege account.