Denial of Service Vulnerability in Kibana by Elastic

CVE-2026-72667

What is CVE-2026-72667?

Kibana, a product by Elastic, is vulnerable to a denial of service attack due to improper resource allocation. An authenticated user with minimal access can exploit the validation capabilities of the Observability log analysis feature by sending a specially crafted request. This action leads Kibana to perform an unbounded amount of concurrent operations, potentially exhausting memory and disrupting service for all users. In well-resourced deployments, the impact might manifest as degraded performance rather than a complete outage, but the simplicity of the attack allows it to be repeated easily.

References