Kibana EUVD-2026-58273

Exploitation requires a valid Kibana account with at least low-privilege access sufficient to interact with TSVB visualization panels (consistent with CVSS PR:L - anonymous unauthenticated exploitation is not possible). The Kibana instance must be network-reachable by the attacker (AV:N), and the TSVB visualization feature must be accessible to the attacker's role. A single authenticated HTTP request is sufficient to trigger the outage with no further user interaction (UI:N). Factors that limit exploitation: authentication is a hard prerequisite; the attacker must hold Kibana privileges allowing creation or editing of TSVB visualizations; impact is strictly limited to service availability (no confidentiality or integrity compromise); and recovery, while disruptive, is achievable by restarting the service. Non-default role restrictions on TSVB access reduce the exploitable user population.

The CVSS 3.1 score of 6.5 (Medium) accurately reflects PR:L - an authenticated user is required, which prevents anonymous internet exploitation and limits the attacker pool. However, the practical severity for organizations is elevated by several factors: the attack complexity is genuinely low (AC:L), a single request causes a complete, persistent availability outage (A:H) rather than degradation, and recovery requires a manual service restart. EPSS data was not provided in the source intelligence. The vulnerability is not listed in CISA KEV, and no POC has been identified, consistent with limited opportunistic exploitation risk. That said, Kibana frequently serves as a security operations and log analysis platform - a persistent DoS against it can blind defenders during an active incident, making it a high-value target for adversaries who have already obtained any level of Kibana credentials. No conflicting signals between data sources are present.

An authenticated Kibana user with access to TSVB visualization panels - such as an analyst or read-write dashboard editor - crafts a TSVB metric configuration containing a deeply nested expression structure and submits it via the standard Kibana UI or directly via the Kibana API. The Kibana backend's synchronous expression evaluator begins processing the payload, monopolizing the Node.js event loop indefinitely. All subsequent requests from all users queue and time out, rendering the Kibana instance completely unavailable, and an administrator must restart the service to restore operations.