CVE-2026-72682CWE-770denial-of-service

CVE-2026-72682

Medium · published September 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-02T00:17Z
Affected products (1)
ProductVersionsFixed in
elastic/kibana≥ 9.3.0, < 9.4.69.4.6
References (1)
https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054 · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:20Z
    Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
    cvelistv5