CVE-2026-72667

Received Received - Intake

Allocation of Resources Without Limits in Kibana

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72667

EUVD

EUVD-2026-58268

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	kibana	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	kibana	8.19.20
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72667 is an Allocation of Resources Without Limits or Throttling vulnerability in Kibana. It allows an authenticated user with minimal privileges to submit a specially crafted request to the Observability log analysis feature, causing Kibana to perform unbounded concurrent work. This exhausts available memory, leading to a denial of service until the service is restarted.

Detection Guidance

Monitor Kibana process memory usage and response times. Check for unusually high concurrent requests to the Observability log analysis feature. Use system monitoring tools like top, htop, or Elasticsearch/Kibana logs to detect elevated memory consumption or degraded performance.

Impact Analysis

This vulnerability can cause Kibana to become unavailable due to memory exhaustion, disrupting log analysis and other services. Well-provisioned systems may experience degraded performance instead of a full outage. The impact depends on system resources and the ability to repeat the attack.

Mitigation Strategies

Upgrade Kibana to version 8.19.20 or 9.4.5 or later. If upgrading is not possible, restrict access to the Observability log analysis feature or disable it temporarily. Ensure no unauthenticated users have access to Kibana.

Hi! I’m here to help you understand CVE-2026-72667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70