Executive brief
Kibana is a data visualization and management platform for the Elastic Stack. A vulnerability in the analytics collections management feature allows an authorized user to crash the service by sending a specially crafted request. This results in a denial of service, making the dashboard and management tools unavailable to all users until the system is manually restarted.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in Kibana's analytics collections management endpoint. The flaw is rooted in improper validation of input sizes, leading to excessive allocation (CAPEC-130) of CPU and memory resources during request processing. An authenticated attacker with at least 'viewer' level privileges can trigger this condition by submitting a request with an oversized input value. This results in a denial of service (DoS) that persists until the service is manually recovered. The issue affects self-managed and Elastic Cloud Hosted deployments but does not affect Elastic Cloud Serverless. A fix is available in version 8.19.16.
Affected products
- Elastic Kibana 8.0.0 to 8.19.15
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: Fixed in version 8.19.16
- 2026-05-28: advisory