Regular Expression DoS in Kibana AI Inference Engine

Executive Summary

CVE-2026-26936 is an inefficient regular expression complexity vulnerability (CWE-1333) found in the AI Inference Anonymization Engine of Kibana. This vulnerability can lead to a Denial of Service (DoS) attack through Regular Expression Exponential Blowup (CAPEC-492). It occurs when custom anonymization rules use inefficient regex patterns that cause excessive processing time, potentially disrupting the service.

This issue affects Kibana versions 8.x from 8.0.0 through 8.19.10 and 9.x from 9.0.0 through 9.2.4, but only if the Elastic AI Assistant for Security is explicitly enabled by configuring an AI connector and activating the AI Assistant feature. It is not enabled by default.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'The primary impact of this vulnerability is a Denial of Service (DoS) condition. An attacker can exploit inefficient regular expressions in the AI Inference Anonymization Engine to cause exponential blowup in regex processing, which can overwhelm system resources and disrupt the availability of the Kibana service.'}, {'type': 'paragraph', 'content': "This can lead to service downtime or degraded performance, affecting users who rely on Kibana's AI Assistant for Security features."}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to inefficient regular expression processing in the AI Inference Anonymization Engine of Kibana when the Elastic AI Assistant for Security is explicitly enabled. Detection involves verifying if the AI Assistant feature is enabled with an AI connector configured (such as OpenAI, Amazon Bedrock, or Elastic Managed LLM) and if custom anonymization rules are in use.

Since the vulnerability arises from inefficient regex processing in custom anonymization rules, detection can focus on checking the Kibana configuration for the AI Assistant feature and the presence of custom anonymization rules.

No specific commands are provided in the available resources to detect exploitation or presence of this vulnerability on the network or system.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Kibana to versions 8.19.11 or 9.2.5 or later, where the vulnerability is resolved.

If upgrading is not immediately possible, disable all custom anonymization rules via the Security AI settings → Anonymization tab in Kibana. This prevents execution of the vulnerable regex pipeline.

Note that the vulnerability only affects systems where the Elastic AI Assistant for Security is explicitly enabled with an AI connector configured and the AI Assistant feature activated.

Useful 0 Not Useful 0