CVE-2026-33465: Elastic Kibana DOS Vulnerability

CVE-2026-33465 Overview

CVE-2026-33465 is a denial of service vulnerability in Elastic Kibana caused by Allocation of Resources Without Limits or Throttling [CWE-770]. An authenticated user with low-level permissions can submit a specially crafted request that triggers excessive resource consumption. The condition renders Kibana unavailable to legitimate users. Elastic addressed the issue in Kibana 8.19.17 and 9.3.0 through security advisory ESA-2026-31.

Critical Impact
An authenticated attacker with minimal privileges can exhaust Kibana resources through a crafted request, disrupting availability of dashboards, alerting, and search interfaces that depend on the Kibana service.

Affected Products

Elastic Kibana versions prior to 8.19.17
Elastic Kibana 9.x versions prior to 9.3.0
Deployments exposing Kibana to authenticated users with low-privilege roles

Discovery Timeline

2026-09-01 - CVE-2026-33465 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database
2026-09-03 - EPSS score recorded at 0.296%

Technical Details for CVE-2026-33465

Vulnerability Analysis

The vulnerability falls under CWE-770, Allocation of Resources Without Limits or Throttling, and maps to CAPEC-130 (Excessive Allocation). Kibana processes an authenticated request path without enforcing bounds on the resources it allocates in response. An attacker submits input that causes Kibana to consume disproportionate CPU, memory, or file handles relative to the request size. Repeated or single well-formed requests can drive the Node.js process into unresponsiveness.

The attacker requires only low-level permissions, which broadens the internal threat surface. Any account provisioned for viewing dashboards or running basic queries can trigger the condition. The impact is limited to availability; the advisory reports no confidentiality or integrity impact.

Root Cause

The root cause is missing input-size or resource-usage limits on a Kibana request handler. When Kibana receives the crafted payload, it allocates resources proportional to attacker-controlled parameters without applying quotas, timeouts, or backpressure. Elastic's fix in 8.19.17 and 9.3.0 introduces the required throttling or validation to bound resource use.

Attack Vector

Exploitation is network-based and requires authentication. An attacker with a valid Kibana account of any role sends the crafted request to a vulnerable Kibana endpoint. No user interaction is needed. Because Kibana is often reachable from internal networks and integrated with single sign-on, low-privilege accounts obtained through phishing or credential reuse are viable exploitation vectors.

No public proof-of-concept, exploit, or CISA KEV listing exists for CVE-2026-33465 at the time of publication. Refer to the Elastic Security Update ESA-2026-31 for vendor-provided technical context.

// No verified proof-of-concept is available.
// See Elastic advisory ESA-2026-31 for vendor details.

Detection Methods for CVE-2026-33465

Indicators of Compromise

Sudden spikes in Kibana Node.js process CPU or resident memory without corresponding user activity
Kibana health checks failing or the service restarting under systemd or Kubernetes supervision
Authenticated requests from low-privilege accounts to endpoints they do not typically use
Elasticsearch backend showing increased query pressure originating from a single Kibana session

Detection Strategies

Baseline Kibana process resource usage and alert on deviations that persist beyond normal query load
Enable Kibana audit logging and correlate request identifiers with sessions that precede resource spikes
Inspect reverse proxy or load balancer logs for unusually large request bodies or slow responses tied to a single user

Monitoring Recommendations

Ship Kibana logs, Elasticsearch audit logs, and host telemetry into a centralized SIEM for correlation
Track availability metrics for the Kibana service and alert on repeated restarts or 5xx error bursts
Review authentication logs for low-privilege accounts issuing atypical request patterns against Kibana APIs

How to Mitigate CVE-2026-33465

Immediate Actions Required

Upgrade Kibana to version 8.19.17 or 9.3.0 as directed in Elastic advisory ESA-2026-31
Audit Kibana user accounts and remove or disable accounts that are unused or over-provisioned
Restrict network exposure of Kibana to trusted management networks and identity-aware proxies
Rotate credentials for any low-privilege Kibana accounts suspected of compromise

Patch Information

Elastic released fixed versions Kibana 8.19.17 and 9.3.0. The patch is documented in Elastic Security Update ESA-2026-31. Operators running self-managed deployments should update binaries and container images. Elastic Cloud customers should confirm their deployment is on a patched build.

Workarounds

Place a reverse proxy in front of Kibana with request size limits, rate limiting, and per-user connection quotas
Reduce the permission scope of Kibana roles until the upgrade is applied
Isolate Kibana in a dedicated network segment to contain availability impact if exploited

bash

# Example NGINX reverse proxy limits in front of Kibana
http {
    limit_req_zone $binary_remote_addr zone=kibana_rl:10m rate=10r/s;
    client_max_body_size 1m;

    server {
        listen 443 ssl;
        server_name kibana.example.com;

        location / {
            limit_req zone=kibana_rl burst=20 nodelay;
            proxy_read_timeout 30s;
            proxy_send_timeout 30s;
            proxy_pass http://kibana-upstream:5601;
        }
    }
}