CVE-2026-63261: Kibana Machine Learning DoS Vulnerability

CVE-2026-63261 Overview

CVE-2026-63261 is an Uncontrolled Resource Consumption vulnerability (CWE-400) affecting Kibana. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature. The request causes the server to exhaust available memory and become unavailable to all users.

The vulnerability maps to CAPEC-130 (Excessive Allocation) and requires network access with low privileges. Exploitation impacts availability without affecting confidentiality or integrity. Elastic published a security update discussion covering Kibana versions 8.19.1, 9.3.8, and 9.4.4.

Critical Impact
An authenticated user with minimal privileges can trigger memory exhaustion on Kibana, resulting in a service-wide denial of service affecting all users of the instance.

Affected Products

Kibana versions prior to 8.19.1
Kibana 9.x versions prior to 9.3.8
Kibana 9.4.x versions prior to 9.4.4

Discovery Timeline

2026-07-21 - CVE-2026-63261 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63261

Vulnerability Analysis

The vulnerability resides in a Kibana machine learning feature endpoint. Kibana fails to enforce upper bounds on resource allocation when processing requests to this feature. An authenticated user crafts a request that triggers unbounded memory allocation on the server.

Memory exhaustion causes the Node.js process backing Kibana to become unresponsive or terminate. All users lose access to Kibana until the service is restarted. Because Kibana serves as the primary interface to Elasticsearch, this disruption affects operational visibility and incident response workflows.

The attack requires only a valid authenticated session with low privileges. No user interaction is required, and the attack executes over the network.

Root Cause

The root cause is missing input validation and resource limits in the machine learning feature's request handler. The handler accepts parameters that influence allocation size without enforcing constraints. This design flaw allows a single request to consume all available heap memory allocated to the Kibana process.

Attack Vector

An attacker authenticates to Kibana using any account with permission to access the machine learning feature. The attacker submits a specially crafted HTTP request targeting the vulnerable endpoint. The server allocates memory based on attacker-controlled parameters until the process exhausts its heap.

No verified proof-of-concept exploit code has been published. Technical specifics are available in the Elastic Security Update Discussion.

Detection Methods for CVE-2026-63261

Indicators of Compromise

Kibana process termination or restart events without corresponding administrator action
Sudden spikes in Kibana Node.js heap usage approaching configured limits
HTTP 5xx responses and timeouts affecting all Kibana users simultaneously
Repeated requests to machine learning API endpoints from a single authenticated session

Detection Strategies

Monitor Kibana audit logs for anomalous request patterns targeting machine learning endpoints from low-privileged accounts
Correlate memory utilization metrics from the Kibana host with request logs to identify the triggering session
Alert on Kibana process crashes and out-of-memory (OOM) killer events in system logs

Monitoring Recommendations

Enable Kibana audit logging and forward events to a centralized SIEM for correlation
Track heap usage using Elastic Stack Monitoring or an external metrics pipeline
Baseline normal machine learning API request rates per user and alert on deviations
Review authentication logs for accounts accessing machine learning features outside expected patterns

How to Mitigate CVE-2026-63261

Immediate Actions Required

Upgrade Kibana to version 8.19.1, 9.3.8, or 9.4.4 or later as specified in the Elastic advisory
Audit user roles and remove machine learning feature access from accounts that do not require it
Review recent Kibana audit logs for suspicious requests to machine learning endpoints
Ensure Kibana processes run under service manager supervision to enable automatic restart after crashes

Patch Information

Elastic released fixed versions in the Kibana 8.19.1, 9.3.8, and 9.4.4 security updates. Refer to the Elastic Security Update Discussion for full version details and upgrade instructions.

Workarounds

Restrict access to the machine learning feature by revoking the associated Kibana privileges from non-essential users
Place Kibana behind a reverse proxy that enforces per-user request rate limits on machine learning API paths
Configure Node.js --max-old-space-size conservatively so a single instance failure does not cascade, and run multiple Kibana instances behind a load balancer
Isolate Kibana from other services on the host to prevent memory exhaustion from affecting adjacent workloads

bash

# Configuration example: restrict machine learning role assignments
# Remove the machine_learning_user and machine_learning_admin roles from users who do not require them
curl -X PUT "https://elasticsearch:9200/_security/user/example_user" \
  -H 'Content-Type: application/json' \
  -u elastic:$ELASTIC_PASSWORD \
  -d '{
    "roles": ["kibana_user"],
    "full_name": "Example User"
  }'