Executive brief
Kibana is a data visualization and management platform for the Elastic Stack. A vulnerability in its machine learning feature allows a user with low-level access to crash the server by sending a specially crafted request. This results in a denial of service, making the platform unavailable to all other users and disrupting data monitoring operations.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in Kibana's machine learning component. A low-privileged authenticated attacker can trigger excessive memory allocation (CAPEC-130) by sending a specifically crafted network request. This leads to memory exhaustion on the Kibana server, resulting in a denial of service (DoS) condition. The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4. As a workaround, users can disable the machine learning feature by setting 'xpack.ml.enabled' to false in the configuration.
Affected products
- Elastic Kibana 8.0.0 to 8.19.18, 9.0.0 to 9.3.7, 9.4.0 to 9.4.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched