CVE-2026-72628: Elastic Kibana DOS Vulnerability

CVE-2026-72628 Overview

CVE-2026-72628 is a denial-of-service vulnerability in Elastic Kibana caused by improper handling of highly compressed data [CWE-409]. An authenticated user with Streams management privileges can submit specially crafted content that expands to a far larger volume during processing. The expansion exhausts memory available to Kibana, and the host terminates the process. The service remains unavailable to all users until an administrator restarts it. Elastic addressed the flaw in Kibana 8.19.21, 9.4.6, and 9.5.2 under advisory ESA-2026-125.

Critical Impact
A single authenticated Streams user can crash the Kibana process, disrupting analytics, dashboards, and alerting for the entire tenant until manual restart.

Affected Products

Elastic Kibana versions prior to 8.19.21
Elastic Kibana 9.x versions prior to 9.4.6
Elastic Kibana 9.5.x versions prior to 9.5.2

Discovery Timeline

2026-09-01 - CVE-2026-72628 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-72628

Vulnerability Analysis

The vulnerability sits in Kibana's Streams management functionality, which accepts compressed input during normal processing. Kibana decompresses supplied content without enforcing bounds on the resulting payload size. An attacker with Streams management privileges submits a small compressed artifact that expands to a disproportionately large in-memory representation, a class of attack commonly known as a decompression bomb (CAPEC-130, Excessive Allocation).

As Kibana attempts to hold the fully expanded content in memory, allocation grows until the operating system out-of-memory killer terminates the Node.js process. The impact is availability only; confidentiality and integrity are not affected. Recovery requires an administrator to restart the Kibana service, and repeated exploitation prevents recovery until the offending account is disabled.

Root Cause

The root cause is missing size validation on decompressed input within a privileged Streams code path. Kibana trusts the compression ratio implied by client input rather than capping expanded output or streaming decompression with a maximum-byte guard. This aligns with CWE-409: Improper Handling of Highly Compressed Data.

Attack Vector

Exploitation requires network access to Kibana and an authenticated session with Streams management privileges. No user interaction is required. The attacker constructs a highly compressible payload, for example a stream of repeating bytes compressed with gzip or a similar algorithm, and submits it through the Streams management interface. Because the vulnerability lives behind an authenticated, privileged surface, the practical risk is highest in environments where Streams management is granted broadly or where lower-trust accounts hold elevated Kibana roles. Refer to the Elastic Kibana security update for vendor-authored technical details.

Detection Methods for CVE-2026-72628

Indicators of Compromise

Kibana process termination events with out-of-memory (OOM) signals in host logs such as dmesg, journalctl, or Kubernetes pod OOMKilled status.
Sudden spikes in Kibana resident set size (RSS) followed by process exit and restart by the service manager.
Streams management API requests carrying unusually small compressed bodies immediately preceding a crash.

Detection Strategies

Correlate Kibana audit logs for Streams management actions with host-level OOM kill events within a short time window.
Alert on repeated Kibana process restarts, particularly when tied to the same authenticated user or API key.
Inspect reverse proxy or load balancer logs for compressed request bodies (Content-Encoding: gzip) targeting Streams endpoints with abnormal decompression ratios.

Monitoring Recommendations

Track Kibana memory utilization and set alerts at defined thresholds prior to OOM termination.
Enable and forward Kibana audit logging to a centralized SIEM for correlation with authentication and infrastructure telemetry.
Monitor privileged role assignments, especially Streams management, and alert on new grants.

How to Mitigate CVE-2026-72628

Immediate Actions Required

Upgrade Kibana to 8.19.21, 9.4.6, or 9.5.2 or later as documented in advisory ESA-2026-125.
Audit accounts and API keys currently holding Streams management privileges and revoke any that are not required.
Enable Kibana audit logging and forward logs to a centralized analytics platform for retention and correlation.

Patch Information

Elastic released fixed builds in Kibana 8.19.21, 9.4.6, and 9.5.2. Full remediation details are published in the Elastic Kibana Security Update ESA-2026-125. Apply the vendor patch as the primary control; other measures are compensating only.

Workarounds

Restrict Streams management privileges to a minimal set of trusted administrators until patching completes.
Place a reverse proxy in front of Kibana that limits request body size and rejects requests with excessive decompression ratios.
Configure host or container memory limits with automated restart policies to reduce mean-time-to-recovery after any DoS event.

bash

# Verify Kibana version and confirm the patched build is installed
/usr/share/kibana/bin/kibana --version

# Example NGINX reverse proxy guardrails in front of Kibana
# limit uncompressed request body size to reduce decompression-bomb impact
client_max_body_size 1m;
proxy_request_buffering on;