CVE-2026-0543CWE-20

Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation

Medium · published January 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-01-13T21:10Z
EPSS history
Timeline
  • 13 JAN 21:10Z
    Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation
    cvelistv5