CVE-2026-72682

Undergoing Analysis Undergoing Analysis - In Progress

Allocation of Resources Without Limits in Kibana

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-72682

EUVD

EUVD-2026-69561

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 9.3.0 (inc) to 9.4.5 (inc)
elastic	kibana	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72682 is a denial-of-service vulnerability in Kibana versions 9.3.0 through 9.4.5. It occurs due to allocation of resources without limits or throttling (CWE-770), allowing an authenticated user with low, read-level Agent Builder privileges to submit a specially crafted request. This causes Kibana to consume excessive memory, terminating the process and denying service to all users.

Detection Guidance

Monitor Kibana process memory usage for unexpected spikes. Check logs for excessive memory allocation errors or crashes in Kibana logs. Verify Agent Builder feature usage patterns for unusual requests.

Impact Analysis

If exploited, this vulnerability can cause Kibana to crash, making the service unavailable to all users. This disrupts operations dependent on Kibana, potentially leading to downtime and loss of access to critical features. The impact is limited to Kibana 9.x versions and requires an authenticated attacker with specific low privileges.

Compliance Impact

This vulnerability primarily impacts availability by causing denial of service through excessive memory consumption. While it does not directly expose or leak data, prolonged unavailability of Kibana could interfere with logging, monitoring, or data processing workflows that are critical for compliance audits under standards like GDPR or HIPAA. Organizations relying on Kibana for such functions may face compliance risks if the service is disrupted.

Mitigation Strategies

Upgrade Kibana to version 9.4.6 or later immediately. If upgrading is not possible, disable the Agent Builder feature in Kibana configuration to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-72682. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70