CVE-2026-63139: Kibana Canvas DoS Vulnerability

CVE-2026-63139 Overview

CVE-2026-63139 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Kibana's Canvas functionality. An authenticated low-privileged user can send a specially crafted request that causes the Kibana server process to terminate. The result is a denial of service impacting all users of the affected Kibana instance.

Elastic published the fix in security update ESA-2026-63, covering Kibana versions 8.19.19, 9.3.8, and 9.4.4. The flaw maps to CAPEC-130 (Excessive Allocation) and requires only low-privilege authenticated access to the Kibana UI or API.

Critical Impact
A single authenticated low-privileged user can crash the Kibana server process, disrupting observability, security analytics, and search workflows for the entire user population.

Affected Products

Kibana versions prior to 8.19.19
Kibana 9.x versions prior to 9.3.8
Kibana 9.4.x versions prior to 9.4.4

Discovery Timeline

2026-07-21 - CVE-2026-63139 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63139

Vulnerability Analysis

The vulnerability resides in Kibana's Canvas feature, which enables users to build custom presentations backed by Elasticsearch data. Canvas exposes server-side endpoints that process user-supplied expressions and rendering instructions. When a malformed or oversized request reaches the vulnerable code path, Kibana allocates resources without bounds checking.

The excess allocation drives the Node.js process past its memory limit or exhausts event loop capacity. Kibana then terminates, denying service to every user connected to that instance. Because Kibana typically operates as a single-tenant frontend to Elasticsearch, the crash removes access to dashboards, alerts, and search interfaces until an operator restarts the service.

The attack requires authentication but not administrative privileges. Any user with access to Canvas functionality can trigger the condition, expanding the risk surface to standard analyst and viewer roles that possess Canvas permissions.

Root Cause

Kibana's Canvas request handlers fail to enforce upper bounds on input size or resource allocation before processing. The absence of quota enforcement and input validation allows attacker-controlled data to drive unchecked memory or compute consumption. This aligns with CWE-400 (Uncontrolled Resource Consumption) and the CAPEC-130 excessive allocation pattern.

Attack Vector

Exploitation proceeds over the network against the Kibana HTTP interface. The attacker authenticates with any account holding Canvas access, then submits a crafted payload to a vulnerable Canvas endpoint. The Kibana server begins allocating resources to service the request and terminates when limits are exceeded. See the Elastic Security Update ESA-2026-63 advisory for vendor confirmation of the affected code path.

Detection Methods for CVE-2026-63139

Indicators of Compromise

Unexpected termination or restart events for the Kibana Node.js process without operator action.
Sudden spikes in memory or CPU consumption on Kibana hosts correlated with Canvas API requests.
Repeated HTTP requests from a single authenticated session to Canvas endpoints followed by service unavailability.

Detection Strategies

Monitor Kibana process supervisor logs (systemd, pm2, container orchestrator) for unplanned exits and out-of-memory kills.
Correlate Kibana audit logs with process crash events to identify the authenticated user and request path preceding termination.
Alert on abnormal request volume or payload sizes targeting Canvas API routes under /api/canvas/.

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized SIEM for correlation with host telemetry.
Track resident memory of the Kibana process and alert when usage exceeds baseline thresholds.
Review authentication logs for low-privileged accounts issuing requests to Canvas endpoints outside of expected usage patterns.

How to Mitigate CVE-2026-63139

Immediate Actions Required

Upgrade Kibana to version 8.19.19, 9.3.8, or 9.4.4 as applicable to your deployment branch.
Audit user roles and revoke Canvas permissions from accounts that do not require the feature.
Configure process supervision to automatically restart Kibana after a crash while investigation is underway.

Patch Information

Elastic addressed the vulnerability in Kibana 8.19.19, 9.3.8, and 9.4.4. Deployment details and release notes are available in the Elastic Security Update ESA-2026-63.

Workarounds

Restrict Canvas access using Kibana role-based access control until patching is complete.
Place a reverse proxy or Web Application Firewall in front of Kibana to rate-limit requests to Canvas API endpoints.
Isolate Kibana instances per tenant or team to contain the blast radius of a successful denial of service.

bash

# Example: restrict Canvas feature via Kibana role configuration
PUT /_security/role/kibana_no_canvas
{
  "kibana": [
    {
      "base": [],
      "feature": {
        "canvas": ["none"],
        "discover": ["read"],
        "dashboard": ["read"]
      },
      "spaces": ["*"]
    }
  ]
}