CVE-2026-72653

Received Received - Intake

Allocation of Resources Without Limits in Kibana

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72653

EUVD

EUVD-2026-58277

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 8.12.0 (inc) to 8.19.18 (inc)
elastic	kibana	From 9.0.0 (inc) to 9.3.7 (inc)
elastic	kibana	From 9.4.0 (inc) to 9.4.3 (inc)
elastic	kibana	8.19.19
elastic	kibana	9.3.8
elastic	kibana	9.4.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72653 is a vulnerability in Kibana where an authenticated user with maintenance window management privileges can submit a malformed payload to cause excessive resource consumption. This leads to a denial of service as Kibana becomes unresponsive for all users and requires manual intervention to recover.

Detection Guidance

Detecting this vulnerability requires checking if your Kibana instance is running a vulnerable version. Use the following commands to check the version: for Linux, run 'curl -XGET http://localhost:5601/api/status' and look for the 'version' field. For Windows, check the Kibana installation directory or use PowerShell to query the version.

Impact Analysis

This vulnerability can cause Kibana to become unresponsive, disrupting access for all users. It requires manual intervention to restore normal operation, potentially leading to downtime and loss of service.

Mitigation Strategies

Upgrade Kibana to a patched version immediately. Affected versions are 8.12.0-8.19.18, 9.0.0-9.3.7, and 9.4.0-9.4.3. Install versions 8.19.19, 9.3.8, or 9.4.4. If upgrading is not possible, restrict access to maintenance window management features for untrusted users as a temporary measure.

Hi! I’m here to help you understand CVE-2026-72653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70