CVE-2026-26931: Elastic Metricbeat Prometheus remote_write denial of service

CVE-2026-26931 · Severity: medium · CVSS 5.7 · Published 2026-03-19

Metricbeat is a data collector used to monitor systems and send metrics to Elasticsearch. The Prometheus remote_write module in affected versions has a memory allocation flaw that allows attackers to cause the service to crash by exhausting memory, leading to monitoring downtime. An attacker with network access to the remote_write endpoint can trigger the vulnerability without requiring authentication.

Technologies: github.com/elastic/beats (Go), github.com/elastic/beats/v7 (Go). Vendors: Elastic, Go.

Quick answers

Is CVE-2026-26931 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26931 being exploited in the wild.
How severe is CVE-2026-26931?
Medium severity, with a CVSS score of 5.7, published 19 March 2026.
Which products and versions are affected?
Elastic Metricbeat 8.0.0-8.19.12, 9.0.0-9.2.4; github.com/elastic/beats (Go) SEMVER:introduced=0; github.com/elastic/beats/v7 (Go) SEMVER:introduced=0,fixed=7.0.0-alpha2.0.20260112100137-de072c4e371e.
Is there a fix for CVE-2026-26931?
Yes. github.com/elastic/beats/v7 (Go): upgrade to 7.0.0-alpha2.0.20260112100137-de072c4e371e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26931 attacked?
It is attacked from the adjacent network or over the network, in a hosted service.
Am I affected by CVE-2026-26931?
Check whether you run Elastic Metricbeat, github.com/elastic/beats (Go) or github.com/elastic/beats/v7 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/elastic/beats/v7 (Go): upgrade to 7.0.0-alpha2.0.20260112100137-de072c4e371e or later
    go get github.com/elastic/beats/v7@v7.0.0-alpha2.0.20260112100137-de072c4e371e

Technical details

The vulnerability is a memory allocation issue (CWE-789) in the Prometheus remote_write HTTP handler that allows excessive memory allocation. The attack vector is network-adjacent with low attack complexity and low privilege requirements, meaning an attacker needs local network access and low privileges to trigger the condition. An attacker can craft malicious requests to the remote_write endpoint that cause Metricbeat to allocate excessive memory, leading to out-of-memory (OOM) errors and process termination. The vulnerability is fixed in Metricbeat versions 8.19.13 and 9.2.5; users unable to upgrade should disable the remote_write module or restrict network access via firewall rules.

Affected products

  • Elastic Metricbeat 8.0.0-8.19.12, 9.0.0-9.2.4

Identifiers

  • CVE-2026-26931
  • GHSA-5vrw-qjxw-89r5
  • GO-2026-4790

Timeline

  • 2026-03-19: disclosed: CVE-2026-26931 published and security update released
  • 2026-03-19: patched: Fixed in Metricbeat 8.19.13 and 9.2.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.