CVE-2026-72674
Received Received - Intake

Allocation of Resources Without Limits in Kibana

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72674
EUVD
EUVD-2026-58261

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 9.3.0 (inc) to 9.3.7 (inc)
elastic kibana From 9.4.0 (inc) to 9.4.3 (inc)
elastic kibana 9.3.8
elastic kibana 9.4.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72674 is an Allocation of Resources Without Limits or Throttling vulnerability in Kibana. It occurs in the Kibana Playground for RAG feature where user-supplied document fields are not bounded in length or deduplicated. This allows a crafted request to generate an excessively large response, causing processing and memory pressure that exhausts system resources.

Detection Guidance

Monitor Kibana instance performance for unusual memory or CPU spikes during Playground for RAG feature usage. Check logs for excessive response sizes or failed requests due to resource exhaustion.

Impact Analysis

This vulnerability can lead to a denial of service by consuming excessive system resources. A single crafted request could make Kibana build a response far larger than the original data, causing processing delays, memory exhaustion, and potential system crashes.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by causing system instability or outages. Excessive resource consumption may lead to degraded performance or unavailability of Kibana services, potentially disrupting data processing or access required for compliance. However, the CVE itself does not directly violate these standards.

Mitigation Strategies

Upgrade Kibana to versions 9.3.8 or 9.4.4 or later immediately. If upgrading is not possible, disable the Playground for RAG feature or restrict access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart