Kibana EUVD-2026-69564

Exploitation requires an authenticated Kibana session with Streams management privileges specifically - this is not a general low-privilege user role but a specific management capability that must be explicitly assigned. The attack is delivered over the network (AV:N) without requiring any additional user interaction. Non-default conditions that limit exposure: the Streams feature must be available and the attacker's account must carry the Streams management role; standard read-only or non-Streams Kibana users cannot trigger this path. Factors that increase risk: the attack requires no special tooling beyond an HTTP client, and a single crafted request is sufficient to exhaust memory and crash the process.

The CVSS 6.5 score reflects a genuine medium-severity issue: network-reachable (AV:N), low complexity (AC:L), low-privilege authenticated (PR:L), with high availability impact (A:H) but no confidentiality or integrity loss. The attack is constrained by the requirement for Streams management privileges, which limits the realistic attacker population to internal users or compromised accounts with that specific role assignment - not any authenticated user. No EPSS score was provided in the input, and the absence of KEV listing and public POC suggests this is not currently under active widespread exploitation. The business impact is nonetheless meaningful: a successful attack takes Kibana fully offline until an operator manually restarts the service, which could disrupt security operations dashboards, log monitoring, and incident response workflows; even a mid-sized municipal IT team in legnica relying on Kibana for operational visibility should treat this as a priority patch. The SSVC exploitation status is 'none' based on available data, but the automatable nature of the payload submission (no UI interaction required) means that any account compromise with the Streams role could trivially be leveraged for persistent denial of service.

An attacker who has obtained or possesses a Kibana account with Streams management privileges authenticates to the Kibana web interface or API and submits a crafted compressed payload - analogous to a zip bomb - to the Streams management endpoint. The Kibana server decompresses the payload during processing without enforcing a size ceiling, rapidly consuming all available heap memory. The OS OOM killer terminates the Kibana process, taking the entire Kibana service offline for all users until an administrator manually restarts it. No public proof-of-concept has been identified, but the technique is well-understood and the implementation is straightforward given knowledge of the Streams API.