CVE-2026-49094
Analyzed Analyzed - Analysis Complete
Uncontrolled Resource Consumption in Kibana via Excessive Allocation

Publication date: 2026-05-28

Last updated on: 2026-06-01

Assigner: Elastic

Description
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-06-01
Generated
2026-06-19
AI Q&A
2026-05-29
EPSS Evaluated
2026-06-18
NVD
CVE-2026-49094
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
elastic kibana From 8.0.0 (inc) to 8.19.16 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Uncontrolled Resource Consumption issue (CWE-400) in Kibana. It allows an authenticated user with viewer-level access to send a request with an oversized input value to an analytics collections management endpoint. When processing this request, Kibana consumes excessive CPU and memory resources.

As a result, the system becomes overwhelmed and unavailable to all users until the service is manually recovered.

Impact Analysis

The vulnerability can lead to a denial of service condition in Kibana. Because the system consumes excessive CPU and memory resources when processing a specially crafted request, Kibana becomes unavailable to all users.

This means legitimate users cannot access Kibana until the service is manually restored, potentially disrupting business operations that depend on Kibana.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, upgrade Kibana to version 8.19.16 or later where the issue is resolved.

If upgrading is not possible immediately, restrict access to the behavioral analytics collections feature to prevent exploitation by authenticated users with viewer-level access.

Note that this vulnerability does not affect Elastic Cloud Serverless deployments.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart