CVE-2026-72644
Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in Kibana via Input Data Manipulation

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-72644
EUVD
EUVD-2026-69563

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic kibana From 9.1.7 (inc) to 9.4.5 (exc)
elastic kibana 9.4.5
elastic kibana 9.5.1
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Uncaught Exception (CWE-248) in Kibana that allows a denial of service via Input Data Manipulation (CAPEC-153). An authenticated low-privileged user can submit a specially crafted request to the Observability AI Assistant, causing an unhandled error that terminates the Kibana process. This affects all users and spaces on the instance until it is restarted.

Detection Guidance

Check Kibana version with 'curl -X GET "http://localhost:5601/api/status" | grep "version"'. If running 9.1.7 to 9.4.4 or 9.5.0, the system is vulnerable. Verify if Observability AI Assistant is enabled via Kibana UI under Management > Features.

Impact Analysis

The impact includes temporary unavailability of the Kibana instance for all users and spaces until the process is restarted. This disrupts access to data and features, potentially affecting operations dependent on Kibana.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing a denial of service, potentially leading to unauthorized data access or processing disruptions. Unhandled errors terminating Kibana may violate availability requirements under GDPR Article 32 and HIPAA Security Rule standards for ensuring access to protected health information.

Mitigation Strategies
  • Upgrade Kibana to version 9.4.5 or 9.5.1 or later to patch the vulnerability.
  • Disable the Observability AI Assistant feature in Kibana if upgrading is not immediately possible.
  • Remove privileges for the Observability AI Assistant from user roles to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart