Kibana EUVD-2026-33031

Authentication to Kibana is required, with at minimum a low-privileged account (CVSS PR:L confirmed). The attacker must have permissions to create or submit Timelion visualizations - this is a standard capability for most non-read-only Kibana roles. The Timelion feature must be available in the deployed Kibana version (Timelion is present in both 8.x and 9.x branches). No special server configuration beyond a standard Kibana deployment is required, as Timelion is enabled by default. Exploitation is constrained by the authentication gate: unauthenticated or anonymous access cannot trigger this vulnerability. The crash impact is service-wide - a single successful attack terminates the Kibana process for all concurrent users.

The CVSS base score of 6.5 (Medium) accurately reflects the limited scope of impact - only availability is affected (C:N/I:N/A:H), with no data exposure or integrity loss. However, the real-world operational risk is elevated by several factors: any low-privileged Kibana user (e.g., a viewer or analyst account) can trigger a full service crash, taking down Kibana for all users simultaneously, which is a high-impact outcome in production environments that depend on Kibana for observability. Attack complexity is low (AC:L) and no user interaction is needed (UI:N), meaning the attack is straightforward to execute. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation has not been observed at scale. No public POC exists at time of analysis. The primary limiting factor is the PR:L authentication requirement - unauthenticated internet-facing attacks are not possible. For organizations with strict Kibana access controls, this is a lower priority; for organizations where Kibana is broadly accessible to internal users or contractors, prioritization should be higher.

An authenticated analyst or viewer-level Kibana user - such as an internal employee or contractor - navigates to the Timelion visualization panel and submits a crafted expression consisting of hundreds of deeply chained or recursively nested Timelion functions. The Kibana server processes the expression server-side, causing memory allocation to grow exponentially with each additional nesting level until the Node.js process exhausts available RAM and crashes. No public POC exploit code has been identified at time of analysis, but the attack requires only a valid Kibana login and knowledge of the Timelion expression syntax.