CVE-2026-33459
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Kibana has an uncontrolled resource consumption vulnerability (CWE-400) leading to denial of service via excessive allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, backend services become unstable, causing service disruption and deployment unavailability for all users.
Risk Assessment
The risk involves complete unavailability of the Kibana service for all users, potentially disrupting business operations and data analysis.
Recommendation
Restrict access to the automatic import feature to trusted users only and implement limits on the size of submitted data.
Original NVD description (English source)
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.