Executive brief
Kibana, a popular data visualization and analysis platform, contains a flaw that allows low-privileged authenticated users to crash the service. By submitting specially crafted data through the Security Solution feature, an attacker can trigger an internal error that terminates the Kibana process, rendering it unavailable to all users until manually restarted. This attack can be repeated, causing repeated outages.
Technical details
An uncaught exception (CWE-248) results from improper input validation (CWE-20) in Kibana's Security Solution feature. The vulnerability requires network access and an authenticated Kibana account with read access and the ability to write documents to an Elasticsearch index that Kibana reads. An attacker supplies malformed data through input data manipulation (CAPEC-153), triggering an unhandled exception on a critical execution path that crashes the Kibana process. No workarounds exist; patches are available in Kibana 8.19.20, 9.3.8, and 9.4.5.
Affected products
- Elastic Kibana 8.0.0 through 8.19.19, 9.0.0 through 9.3.7, 9.4.0 through 9.4.4
Timeline
- 2026-08-13: disclosed: CVE-2026-72660 disclosed; ESA-2026-101 published
- 2026-08-13: patched: Patches released: Kibana 8.19.20, 9.3.8, 9.4.5