What is the CVSS score of EUVD-2026-58261?

EUVD-2026-58261 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Kibana EUVD-2026-58261

| CVE-2026-72674 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-13 elastic

GHSA-jx2m-7cw3-3cf8

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible web feature requiring only a valid user session (PR:L); single crafted request suffices (AC:L); impact is availability-only with no data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:07 vuln.today

CVE Published

Aug 13, 2026 - 19:11 cve.org

MEDIUM 6.5

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

AnalysisAI

Denial of service in Kibana's Playground for RAG feature allows a low-privileged authenticated user to exhaust the memory and processing resources of a Kibana instance via a single crafted request. The vulnerable endpoint accepts a user-supplied list of document fields without enforcing any length bound or deduplication, enabling a request to trigger construction of a response orders of magnitude larger than the underlying data. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. Elastic has released fixes in versions 9.3.8 and 9.4.4.

Technical ContextAI

Kibana is the visualization and query front-end of the Elastic Stack (ELK). The Playground for RAG (Retrieval-Augmented Generation) is a feature that allows users to interactively build document-grounded LLM queries against Elasticsearch indices. The vulnerability maps to CWE-770 (Allocation of Resources Without Limits or Throttling) and CAPEC-130 (Excessive Allocation): the server-side code that assembles a response from matching documents iterates over a caller-supplied field list without capping its length or collapsing duplicates, causing memory and CPU consumption to grow proportionally to the field list size rather than to the actual data size. CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* indicates all Kibana versions prior to the fix releases are affected.

RemediationAI

The primary fix is to upgrade Kibana to version 9.3.8 (on the 9.3.x branch) or 9.4.4 (on the 9.4.x branch), as confirmed by Elastic advisory ESA-2026-91 at https://discuss.elastic.co/t/kibana-9-3-8-9-4-4-security-update-esa-2026-91/389533. If an immediate upgrade is not feasible, a practical compensating control is to restrict access to the Kibana Playground for RAG feature to the smallest possible set of trusted users via Kibana role-based access control, reducing the pool of accounts that could trigger the unbounded allocation. Network-layer rate limiting on the relevant Kibana API endpoints (applied at a reverse proxy or API gateway) can further reduce the blast radius of a single malicious request, though it does not eliminate the root cause. Disabling the Playground feature entirely via Kibana configuration is an option if the feature is not operationally required, with the trade-off of losing RAG query capability.