Executive brief
Kibana is an analytics and visualization platform used to monitor and explore data from Elasticsearch clusters. An authenticated user with minimal read-only alerting permissions can crash the entire Kibana service by sending a single malformed request, forcing all users to lose access until administrators restart the service.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in Kibana's alerting feature that lacks proper limits or throttling on memory/CPU allocation. An authenticated attacker with only read-only access to the alerting feature can craft a malicious payload that triggers excessive resource consumption in the Kibana process. The attack requires network access and valid authentication credentials, but no user interaction. A single request is sufficient to cause a complete denial of service, rendering the entire Kibana instance unavailable until the process is restarted. The issue is resolved in versions 8.19.20 and 9.4.5.
Affected products
- Elastic Kibana 8.0.0 through 8.19.19, 9.0.0 through 9.4.4
Timeline
- 2026-08-13: disclosed: CVE-2026-72651 published; ESA-2026-106 advisory released
- 2026-08-13: patched: Fixed in Kibana 8.19.20 and 9.4.5