CVE-2026-0531
Resource Exhaustion in Kibana Fleet via Bulk Retrieval Requests
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | kibana | From 7.10.0 (inc) to 7.17.29 (inc) |
| elastic | kibana | From 8.0.0 (inc) to 8.19.9 (inc) |
| elastic | kibana | From 9.0.0 (inc) to 9.1.9 (inc) |
| elastic | kibana | From 9.2.0 (inc) to 9.2.3 (inc) |
| elastic | kibana | 8.19.10 |
| elastic | kibana | 9.1.10 |
| elastic | kibana | 9.2.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Kibana Fleet (CVE-2026-0531) involves allocation of resources without limits or throttling (CWE-770). An attacker with low-level privileges equivalent to the viewer role can send a specially crafted bulk retrieval request that causes redundant database retrieval operations. This excessive memory consumption leads to the server crashing and becoming unavailable to all users, resulting in a denial of service. [1]
How can this vulnerability impact me? :
The vulnerability can cause the Kibana server to crash and become unavailable due to excessive memory consumption triggered by a crafted request. This results in denial of service, impacting the availability of the application for all users. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Kibana to a fixed version. The issue is resolved in Kibana versions 8.19.10, 9.1.10, and 9.2.4. There are no workarounds available for users unable to upgrade. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.