CVE-2026-49087

Analyzed Analyzed - Analysis Complete

Allocation of Resources Without Limits in Kibana

Publication date: 2026-07-01

Last updated on: 2026-07-02

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-02

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-49087

EUVD

EUVD-2026-41088

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 8.0.0 (inc) to 8.19.15 (exc)
elastic	kibana	From 9.0.0 (inc) to 9.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-49087 is a vulnerability in Kibana versions 8.0.0 through 8.19.14 and 9.0.0 through 9.3.3 that allows an authenticated user to exploit a resource allocation flaw. Specifically, by submitting a specially crafted bulk deletion request via the Timeline feature, the attacker can cause excessive resource consumption. This happens because Kibana does not limit or throttle resource allocation properly, leading to a denial of service condition where Kibana becomes unavailable.

Detection Guidance

This vulnerability involves an authenticated user submitting a specially crafted bulk deletion request to Kibana, causing excessive resource consumption and denial of service.

Detection would involve monitoring for unusual or excessive bulk deletion requests to the Kibana Timeline feature from authenticated users.

Since the vulnerability is triggered by specific API requests, you can inspect Kibana access logs for high volumes or abnormal patterns of bulk deletion requests.

There are no specific commands provided in the available resources to detect this vulnerability directly.

Impact Analysis

This vulnerability can impact you by causing a denial of service (DoS) on your Kibana instance. An authenticated user can trigger excessive resource consumption, which may render Kibana unavailable and disrupt access to its services. This can affect the availability of your monitoring and visualization tools, potentially impacting operational workflows that depend on Kibana.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Kibana to version 8.19.15 or 9.3.4 or later, where the issue is resolved.

There are no available workarounds for users unable to upgrade.

Note that Elastic Cloud Serverless deployments were automatically remediated before public disclosure.

Hi! I’m here to help you understand CVE-2026-49087. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70