Executive brief
Kibana, a web-based analytics and visualization platform used to monitor and explore data, contains a flaw that allows authenticated users to cause it to become unresponsive. A specially crafted query can force Kibana to consume unbounded CPU and memory resources, rendering the service unavailable to all users until manually restarted. Even users with read-only access can trigger this issue with a single malicious request.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) in Kibana's connector reporting operation. The vulnerable component accepts query expressions without enforcing limits on expression size or complexity. When an oversized expression is submitted, the Kibana process enters an unbounded evaluation loop, consuming all available CPU cycles and preventing normal request handling. The attack requires network access and valid authentication credentials (but only read-only privileges), with no user interaction needed. An authenticated attacker can send a single crafted request to trigger denial of service affecting all users. The issue has been patched in Kibana 8.19.20 and 9.4.5; users on earlier versions are advised to upgrade immediately.
Affected products
- Elastic Kibana 8.0.0 to 8.19.19, 9.0.0 to 9.4.4
Timeline
- 2026-08-13: disclosed: CVE-2026-49089 publicly disclosed
- 2026-08-13: patched: Fixed in Kibana 8.19.20 and 9.4.5