Executive brief
Metricbeat is a data collector used to monitor systems and send metrics to Elasticsearch. The Prometheus remote_write module in affected versions has a memory allocation flaw that allows attackers to cause the service to crash by exhausting memory, leading to monitoring downtime. An attacker with network access to the remote_write endpoint can trigger the vulnerability without requiring authentication.
Technical details
The vulnerability is a memory allocation issue (CWE-789) in the Prometheus remote_write HTTP handler that allows excessive memory allocation. The attack vector is network-adjacent with low attack complexity and low privilege requirements, meaning an attacker needs local network access and low privileges to trigger the condition. An attacker can craft malicious requests to the remote_write endpoint that cause Metricbeat to allocate excessive memory, leading to out-of-memory (OOM) errors and process termination. The vulnerability is fixed in Metricbeat versions 8.19.13 and 9.2.5; users unable to upgrade should disable the remote_write module or restrict network access via firewall rules.
Affected products
- Elastic Metricbeat 8.0.0-8.19.12, 9.0.0-9.2.4
Timeline
- 2026-03-19: disclosed: CVE-2026-26931 published and security update released
- 2026-03-19: patched: Fixed in Metricbeat 8.19.13 and 9.2.5