# CVE-2026-26931: Elastic Metricbeat Prometheus remote_write denial of service

Source: https://junglewise.ai/threats/cve-2026-26931-elastic-metricbeat-prometheus-remote-write-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26931 · Severity: medium · CVSS 5.7 · Published 2026-03-19

Metricbeat is a data collector used to monitor systems and send metrics to Elasticsearch. The Prometheus remote_write module in affected versions has a memory allocation flaw that allows attackers to cause the service to crash by exhausting memory, leading to monitoring downtime. An attacker with network access to the remote_write endpoint can trigger the vulnerability without requiring authentication.

Technologies: [github.com/elastic/beats (Go)](https://junglewise.ai/threats/technologies/github-com-elastic-beats), [github.com/elastic/beats/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-elastic-beats-v7). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-26931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26931 being exploited in the wild.

**How severe is CVE-2026-26931?** Medium severity, with a CVSS score of 5.7, published 19 March 2026.

**Which products and versions are affected?** Elastic Metricbeat 8.0.0-8.19.12, 9.0.0-9.2.4; github.com/elastic/beats (Go) SEMVER:introduced=0; github.com/elastic/beats/v7 (Go) SEMVER:introduced=0,fixed=7.0.0-alpha2.0.20260112100137-de072c4e371e.

**Is there a fix for CVE-2026-26931?** Yes. github.com/elastic/beats/v7 (Go): upgrade to 7.0.0-alpha2.0.20260112100137-de072c4e371e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26931 attacked?** It is attacked from the adjacent network or over the network, in a hosted service.

**Am I affected by CVE-2026-26931?** Check whether you run Elastic Metricbeat, github.com/elastic/beats (Go) or github.com/elastic/beats/v7 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/elastic/beats/v7 (Go): upgrade to 7.0.0-alpha2.0.20260112100137-de072c4e371e or later

  ```sh
  go get github.com/elastic/beats/v7@v7.0.0-alpha2.0.20260112100137-de072c4e371e
  ```


## Technical details

The vulnerability is a memory allocation issue (CWE-789) in the Prometheus remote_write HTTP handler that allows excessive memory allocation. The attack vector is network-adjacent with low attack complexity and low privilege requirements, meaning an attacker needs local network access and low privileges to trigger the condition. An attacker can craft malicious requests to the remote_write endpoint that cause Metricbeat to allocate excessive memory, leading to out-of-memory (OOM) errors and process termination. The vulnerability is fixed in Metricbeat versions 8.19.13 and 9.2.5; users unable to upgrade should disable the remote_write module or restrict network access via firewall rules.

## Affected products

- Elastic Metricbeat 8.0.0-8.19.12, 9.0.0-9.2.4

## Identifiers

- CVE-2026-26931
- GHSA-5vrw-qjxw-89r5
- GO-2026-4790

## Timeline

- 2026-03-19: disclosed: CVE-2026-26931 published and security update released
- 2026-03-19: patched: Fixed in Metricbeat 8.19.13 and 9.2.5

## References

- [https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532](https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532)

## Related threats

- [Elastic Docker images certificate validation flaw in OS bundle](https://junglewise.ai/threats/cve-2026-115714-improper-certificate-validation-cwe-295-in-the-operating-system)
- [Packetbeat does not properly validate an array index in multiple protocol parser components](https://junglewise.ai/threats/cve-2026-26933-packetbeat-does-not-properly-validate-an-array-index-in-multiple)
- [GO-2026-4360 - Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats](https://junglewise.ai/threats/cve-2026-0528-metricbeat-affected-by-multiple-denial-of-service-vulnerabilities)
- [GO-2025-4252 - Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in github.com/elastic/beats](https://junglewise.ai/threats/cve-2025-68383-filebeat-beats-has-buffer-overflow-via-malformed-syslog-message)
- [Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments](https://junglewise.ai/threats/cve-2025-68388-elasticsearch-packetbeat-has-excessive-allocation-of-memory-and)