AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticCVE-2026-72682

Elastic Kibana: denial of service

Elastic

CVE-2026-72682 · Published Sep 1, 2026 · updated Sep 2, 2026

Medium6.5
No fix yet
Elastic advisory

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 9.3.0, <= 9.4.5No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More Elastic advisories

All Elastic
Medium 5.4Sep 1Elasticsearch: missing authorizationCVE-2026-78607no fix yetMedium 6.5Sep 1Elastic Kibana: missing authorizationCVE-2026-78608no fix yetHigh 7.3Sep 1Elastic Kibana: path traversalCVE-2026-78592no fix yetMedium 4.3Sep 1Elastic Kibana: missing authorizationCVE-2026-78597no fix yetMedium 4.3Sep 1Elastic Kibana: missing authorizationCVE-2026-78603no fix yetMedium 5.9Sep 1Elasticsearch: request smugglingCVE-2026-78605no fix yet