CVE-2026-0528: Elastic Kibana DOS Vulnerability

CVE-2026-0528 Overview

CVE-2026-0528 is a Denial of Service vulnerability affecting Elastic Metricbeat. The flaw stems from Improper Validation of Array Index [CWE-129] in the Graphite server metricset and Zookeeper server metricset. A related Improper Input Validation [CWE-20] weakness exists in the Prometheus helper module. Attackers can send specially crafted, malformed payloads to trigger crashes and disrupt metric collection. Although the affected component is Metricbeat, the vulnerability is published under the Elastic Kibana product line in the National Vulnerability Database (NVD).

Critical Impact
Remote, unauthenticated attackers can crash Metricbeat agents by sending malformed Graphite, Zookeeper, or Prometheus metric data, disrupting observability pipelines.

Affected Products

Elastic Metricbeat (tracked under elastic:kibana in NVD)
Metricbeat Graphite server metricset
Metricbeat Zookeeper server metricset and Prometheus helper module

Discovery Timeline

2026-01-13 - CVE-2026-0528 published to NVD
2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-0528

Vulnerability Analysis

The vulnerability resides in how Metricbeat parses incoming metric payloads from third-party sources. The Graphite server metricset and Zookeeper server metricset both fail to validate array indices when processing inbound data. The Prometheus helper module fails to sanitize malformed metric data before processing. An attacker who can reach the listening metricset endpoints over the network can submit a crafted payload that causes the Metricbeat process to terminate or become unresponsive.

Metric ingestion downtime cascades into observability blind spots, breaking dashboards, alerts, and Security Information and Event Management (SIEM) telemetry that depend on Metricbeat. The vulnerability does not enable code execution, data tampering, or information disclosure. Availability is the sole impacted property.

Root Cause

The root cause is twofold. First, the Graphite and Zookeeper metricsets dereference array elements without first confirming the supplied index falls within bounds [CWE-129]. Second, the Prometheus helper module accepts metric records without enforcing structural validation [CWE-20]. Both conditions allow malformed input to drive Metricbeat into an unhandled error path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker locates a Metricbeat instance exposing the Graphite or Zookeeper server metricset, or one configured to scrape attacker-controlled Prometheus endpoints. The attacker then transmits a malformed payload, triggering the crash. Refer to the Elastic Security Update Announcement for vendor-confirmed details.

Detection Methods for CVE-2026-0528

Indicators of Compromise

Unexpected Metricbeat process crashes or restarts logged by the host service manager
Gaps in metric ingestion timelines correlating with inbound traffic from unknown sources to Graphite or Zookeeper metricset listening ports
Prometheus scrape errors or panics referenced in Metricbeat logs immediately before service termination

Detection Strategies

Monitor Metricbeat application logs for stack traces, panics, or index out of range errors tied to the Graphite, Zookeeper, or Prometheus modules
Alert on repeated Metricbeat service restarts within short time windows using host or container orchestrator telemetry
Inspect network flows to Metricbeat metricset ports for malformed protocol traffic originating from unauthorized sources

Monitoring Recommendations

Enable verbose logging on Metricbeat during incident triage to capture parser-level failures
Forward Metricbeat process health and crash events to a centralized logging or SIEM platform for correlation
Track Metricbeat version inventory across the fleet to confirm patched builds are deployed

How to Mitigate CVE-2026-0528

Immediate Actions Required

Upgrade Metricbeat to a fixed release as identified in the Elastic Security Advisory ESA-2026-01
Restrict network access to the Graphite and Zookeeper server metricset listening ports to trusted sources only
Validate Prometheus scrape targets and reject metric endpoints outside of authorized service inventories

Patch Information

Elastic published fixed Metricbeat versions in the Elastic Security Update Announcement covering the 8.19, 9.1, and 9.2 release branches. Administrators should apply the vendor-provided patched builds rather than attempting source-level fixes.

Workarounds

Disable the Graphite server metricset, Zookeeper server metricset, and Prometheus helper module if they are not required
Place Metricbeat collectors behind a firewall or network access control list that limits ingress to authorized metric producers
Run Metricbeat under a process supervisor that automatically restarts the agent to reduce downtime until patches are applied

bash

# Example: disable affected metricsets in metricbeat.yml
metricbeat.modules:
  - module: graphite
    enabled: false
  - module: zookeeper
    enabled: false
  - module: prometheus
    enabled: false