CVE-2026-72653
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user authorized to manage maintenance windows can submit a specially crafted malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.
Risk Assessment
An attacker with maintenance window management privileges can cause prolonged unavailability of Kibana, requiring manual intervention and disrupting security operations.
Recommendation
Install vendor security patches and restrict maintenance window management privileges. Implement resource monitoring and automatic restart procedures.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.