Kibana EUVD-2026-58277

Exploitation requires an active, authenticated Kibana session belonging to a user who has been explicitly granted the 'manage maintenance windows' privilege - this is not a default low-privilege capability and must be assigned by an administrator. The attacker must submit a specially crafted, malformed payload to the maintenance windows management interface; normal well-formed requests do not trigger the flaw. Exploitation is limited to the Kibana application tier; the underlying Elasticsearch cluster is not directly affected. The scope is unchanged (S:U), meaning the impact does not propagate beyond the Kibana process itself. Factors limiting exploitation: authentication is mandatory (PR:L, confirmed by CVSS vector); the required maintenance window management role restricts the population of potential attackers; and the attack produces availability impact only, with no confidentiality or integrity consequences.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a base score of 6.5 (Medium), which accurately reflects the risk profile. The network attack vector and low attack complexity mean exploitation is straightforward once the attacker has the required role. The privileged requirement (PR:L) is the primary limiting factor - the attacker must be authenticated and explicitly authorized to manage maintenance windows, which is not a default low-privilege capability. There is no confidentiality or integrity impact, and scope is unchanged. The availability impact is rated High (A:H), which is consistent with the description's claim that Kibana becomes permanently unresponsive without manual restart. This is a targeted denial-of-service risk rather than a broad opportunistic threat: unauthenticated attackers cannot exploit it, and the maintenance window management role is typically limited to administrators or power users. No EPSS score was provided in source data, and the vulnerability is not present in the CISA KEV catalog, so there is no confirmed evidence of active exploitation. No POC has been identified. The practical risk is highest in multi-tenant Kibana deployments where a malicious or compromised internal user with this specific role could disrupt all tenants' access.

An attacker who holds a Kibana account with maintenance window management privileges - or who has compromised such an account - crafts a malformed JSON payload and submits it to the Kibana maintenance windows API endpoint. The Kibana server-side process begins allocating resources without bound in response to the malformed input, consuming all available memory or CPU until the Node.js process becomes fully unresponsive. All other Kibana users lose access to the UI and any dependent alerting or dashboard functionality until an operator manually restarts the Kibana process.