CVE-2026-49089

Received Received - Intake

Allocation of Resources Without Limits in Kibana

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-49089

EUVD

EUVD-2026-58244

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	8.0.0
elastic	kibana	to 8.19.20 (exc)
elastic	kibana	9.0.0
elastic	kibana	to 9.4.5 (exc)
elastic	kibana	8.19.20
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-49089 is an Allocation of Resources Without Limits or Throttling vulnerability in Kibana. It allows an authenticated user with read-only privileges to cause a denial of service by sending a single request with an oversized query expression. The lack of size limits on query expressions during connector reporting operations causes Kibana to spend excessive time processing the request, rendering it unable to serve other users until restarted.

Detection Guidance

Monitor Kibana process CPU and memory usage for abnormal spikes during connector reporting operations. Check logs for unusually large query expressions in requests. Use tools like top, htop, or ps to observe Kibana process behavior. Examine access logs for requests to /api/reporting or similar endpoints with large payloads.

Impact Analysis

This vulnerability can disrupt service availability by causing Kibana to become unresponsive. Users may experience downtime until the Kibana process is restarted. It requires an authenticated attacker with read-only privileges to exploit, but no specific indicators of compromise have been identified.

Mitigation Strategies

Upgrade Kibana to version 8.19.20 or 9.4.5 or later immediately. If upgrading is not possible, restrict access to connector reporting operations and monitor for suspicious large query requests. Disable unnecessary connectors until patched.

Hi! I’m here to help you understand CVE-2026-49089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70