Kibana EUVD-2026-20521

Medium real-world risk, supported by converging signals. CVSS 6.5 reflects attack vector network (AV:N), low complexity (AC:L), low privileges required (PR:L), and high availability impact (A:H). The CVSS vector confirms unauthenticated attack is not possible-an authenticated user account is mandatory, which narrows the attacker pool to legitimate Kibana users, internal threat actors, or compromised accounts. No EPSS probability was provided, and neither KEV status nor public exploit code availability was reported, suggesting this is not yet confirmed as actively exploited. However, the vulnerability is straightforward to execute once authenticated: an attacker with user credentials simply needs to craft large requests to the import endpoint and send them concurrently-no complex exploitation technique is required. The real-world severity depends on deployment context: air-gapped or internal Kibana instances with restricted user access face lower risk, while internet-facing instances with many users or federated authentication face higher risk. The impact is availability-only (denial of service), not data breach or integrity loss, reducing urgency relative to critical vulnerabilities. Remediation via patching or architectural mitigations (rate limiting, resource quotas) is practical.

An authenticated Kibana user (either a legitimate account or one obtained through credential compromise) submits 10-20 concurrent HTTP POST requests to the automatic import endpoint, each with input parameters set to extremely large values (e.g., gigabyte-scale file sizes or array counts). The backend lacks input validation and resource throttling, causing each request to allocate excessive memory or CPU threads. Within seconds, these concurrent allocations exhaust available resources on the Kibana/Elasticsearch backend, causing query timeouts, connection pool exhaustion, and eventual service unavailability for all users. Attackers would exploit this to disrupt monitoring and analytics availability, potentially masking other malicious activity or causing operational impact to customers relying on real-time dashboards. No public exploit code has been identified, suggesting the vulnerability requires understanding of Kibana's API structure and the import feature's internals.