EUVD-2026-87799
GHSA-95p2-xgxw-hm57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Kibana user
-
ExploitSend crafted request triggering excessive allocation
-
ExecutionExhaust Kibana memory/resources
-
ImpactDenial of service for all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Kibana session at low privilege (PR:L) with network reachability to the Kibana HTTP interface; the attacker then issues requests that trigger uncontrolled/excessive resource allocation (CAPEC-130). No user interaction is needed (UI:N) and default configurations of network-exposed Kibana are in scope once a low-privilege account exists. Limiting factors: authentication is mandatory (not exploitable by fully unauthenticated attackers per the stated vector), impact is confined to availability of the Kibana instance (no data disclosure or modification), and the input does not identify the exact vulnerable feature, so the precise request pattern is not confirmed. Patched in Kibana 8.19.22, 9.4.7, and 9.5.3. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5 MEDIUM) is internally consistent with the description: a network-reachable, low-complexity, availability-only denial of service requiring some authentication (PR:L). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or a widely available exploit - this reads as a real but moderate defense-in-availability issue rather than an urgent priority. The absence of confidentiality/integrity impact (C:N/I:N) caps the ceiling: the worst realistic outcome is service disruption of a Kibana instance, not data theft or cluster takeover. Because PR:L requires an authenticated principal, exposure is materially reduced for deployments that do not grant Kibana access to untrusted users. The description is terse ('Uncontrolled Resource Consumption ... via Excessive Allocation') and does not name the specific endpoint or feature that acts as the allocation sink - this gap should be verified against the vendor advisory (ESA-2026-181) before ruling out lower-privilege or edge-case unauthenticated paths. |
| Exploit ScenarioDerived | An authenticated Kibana user with low privileges sends crafted requests to Kibana that force excessive memory or resource allocation, exhausting the process and rendering the Kibana front-end unavailable to all users until it is restarted. The attack is remote (AV:N) and low-complexity (AC:L), but no public exploit code was identified at time of analysis, and the impact is limited to availability of the Kibana service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Denial of service in Elastic Kibana allows an authenticated low-privilege user with network access to the Kibana HTTP interface to exhaust server resources and render the instance unavailable. The flaw is an uncontrolled resource consumption issue (CWE-400, CAPEC-130 Excessive Allocation) rated CVSS 3.1 base 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning availability impact only, with no confidentiality or integrity loss and no user interaction required. Exploitation requires a valid session at low privilege (PR:L), so a fully unauthenticated attacker cannot trigger it per the assessed vector; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis. Elastic has published fixed versions in 8.19.22, 9.4.7, and 9.5.3.
RemediationAI
Vendor-released patches are available: upgrade Kibana to 8.19.22, 9.4.7, or 9.5.3 depending on your release line, as documented in Elastic's advisory ESA-2026-181 (https://discuss.elastic.co/t/kibana-8-19-22-9-4-7-9-5-3-security-update-esa-2026-181/390685). Until upgrades can be staged, compensating controls are worth applying because authentication is mandatory (PR:L) and the impact is availability-only: enforce least privilege and audit which accounts hold even low-privilege Kibana roles, since removing unused or over-broad accounts shrinks the set of users who can trigger the allocation path (trade-off: tighter role assignments may disrupt legitimate dashboards or saved-object workflows and should be validated against real usage). Restrict network reachability to the Kibana HTTP interface using firewall rules, reverse-proxy ACLs, or private networking so that only trusted networks and users can reach it (trade-off: this breaks remote or partner access and is impractical for internet-facing deployments, which instead need prompt patching). Place a reverse proxy or API gateway in front of Kibana with request rate limiting and per-connection concurrency caps to blunt excessive-allocation attempts (trade-off: aggressive limits can degrade legitimate bulk dashboard, reporting, or export operations, so thresholds must be tuned in staging). Monitor Kibana process memory, CPU, and connection counts and alert on sustained growth patterns to detect the availability attack early. Note that because the specific vulnerable endpoint is not identified in the available data, endpoint- or feature-specific workarounds cannot be recommended; upgrading to a patched version remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kibana is Elastic's browser-based analytics and visualization front end that sits in front of Elasticsearch, exposing a large HTTP API that authenticated users can call directly. The reported weakness class is CWE-400 (Uncontrolled Resource Consumption), realized through CAPEC-130 (Excessive Allocation): the vulnerable code path does not adequately bound or throttle the resources a single request or set of requests can consume, so a low-privilege authenticated user can drive memory, CPU, or connection-pool exhaustion on the Node.js-based Kibana process. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, the attack is network-reachable over the Kibana HTTP endpoint, low complexity, and requires only a low-privileged authenticated session; scope is unchanged, so the impact stays within the Kibana service itself. The supplied CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* uses a wildcard version, indicating the affected set spans multiple Kibana release lines rather than a single build, consistent with the advisory covering 8.19.x, 9.4.x, and 9.5.x. The specific vulnerable feature or endpoint is not identified in the available intelligence, so the exact request pattern that triggers excessive allocation remains unconfirmed.
Know when Kibana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable low-complexity request abuse requiring an authenticated low-privilege account (PR:L), no interaction, availability-only impact so C:N/I:N/A:H.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
DescriptionCVE.org
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Authorization bypass in Kibana's Fleet package installation process lets an authenticated user who holds delegated Fleet
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Exploit-DB