CVE-2026-78586
Received Received - Intake

Allocation of Resources Without Limits in Kibana

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Elastic

Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78586
EUVD
EUVD-2026-70064

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 8.0.0 (inc) to 8.19.15 (inc)
elastic kibana From 9.0.0 (inc) to 9.3.4 (inc)
elastic kibana From 9.4.0 (inc) to 9.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78586 is a vulnerability in Kibana where an authenticated user with low privileges can submit a specially crafted request that causes Kibana to consume excessive memory without any limits or throttling. This leads to a denial of service as Kibana becomes unavailable to all users.

Detection Guidance

Monitor Kibana memory usage for unusual spikes or sustained high consumption. Check logs for excessive allocation errors or failed requests. Use system monitoring tools like top, htop, or ps to track Kibana process memory usage.

Impact Analysis

This vulnerability can impact you by making Kibana unavailable due to excessive memory consumption. If exploited, it could disrupt access to Kibana for all users, leading to downtime and potential loss of service functionality.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing unavailability of Kibana services due to denial of service. Unauthorized memory consumption may lead to disruptions in data processing or access, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade Kibana to the latest patched versions: 8.19.16, 9.3.5, or 9.4.2. If upgrading is not possible, restrict access to Kibana to trusted users only and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart