CVE-2026-72660
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An uncaught exception in Kibana, resulting from improper input validation, can lead to denial of service. An authenticated user with low privileges can submit specially crafted data that causes an internal error and terminates the Kibana process. Kibana becomes unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.
Risk Assessment
An attacker with minimal privileges can repeatedly disable Kibana, causing prolonged unavailability of the tool for the entire organization and disrupting security operations.
Recommendation
Apply vendor-provided updates and restrict access to Kibana to trusted users only. Monitor logs for unusual requests and consider implementing rate limiting mechanisms.
Original NVD description (English source)
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.