CVE-2026-72651
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user with read-only privileges to the alerting feature can submit a specially crafted malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.
Risk Assessment
An attacker with minimal privileges (read-only alerts) can disable Kibana with a single request, causing disruptions in access to alerts and other functions for the entire organization.
Recommendation
Install vendor security patches and restrict access to alerting features. Implement resource usage monitoring and automatic restarts in case of anomalies.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.