CVE-2026-72644: Elastic Kibana DOS Vulnerability

CVE-2026-72644 Overview

CVE-2026-72644 is an uncaught exception vulnerability [CWE-248] in Elastic Kibana that leads to a denial-of-service condition. An authenticated user with only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request. The request produces an unhandled error condition that terminates the Kibana process. All users and spaces on the affected instance lose service until an administrator restarts it. Elastic addressed the issue in Kibana 9.4.5 and 9.5.1 through security advisory ESA-2026-115.

Critical Impact
A single low-privileged authenticated request to the Observability AI Assistant can crash the Kibana process, denying service to every user and space on the instance until restart.

Affected Products

Elastic Kibana versions prior to 9.4.5
Elastic Kibana 9.5.0
Deployments where authenticated users hold Observability AI Assistant feature access

Discovery Timeline

2026-09-01 - CVE-2026-72644 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-72644

Vulnerability Analysis

The flaw resides in the Observability AI Assistant feature within Kibana. The component fails to catch an exception raised while processing a malformed request. When Node.js encounters the uncaught exception, the Kibana process terminates rather than isolating the failure to the requesting session. Because Kibana runs as a single shared process serving all users and spaces, the crash removes access for the entire tenant on that instance. Recovery requires an administrator or supervisor process to restart Kibana.

Root Cause

The root cause is missing exception handling [CWE-248] in the request path for the Observability AI Assistant. Input data manipulation (CAPEC-153) drives the application into a code branch where the raised error is not wrapped in a try/catch block or handled by a route-level error middleware. The exception propagates to the Node.js runtime and triggers process termination.

Attack Vector

Exploitation requires network access to the Kibana HTTP interface and valid credentials for an account with the feature privilege to use the Observability AI Assistant. No user interaction is needed. The attacker sends a specially crafted request to the Assistant endpoint. The request payload triggers the unhandled error condition and crashes the Kibana instance. Confidentiality and integrity are not affected, but availability is fully lost on the target instance.

Verified proof-of-concept code has not been published. Refer to the Elastic Security Update ESA-2026-115 for vendor technical details.

Detection Methods for CVE-2026-72644

Indicators of Compromise

Unexpected termination of the Kibana Node.js process with an uncaughtException entry in Kibana logs.
Repeated HTTP requests to Observability AI Assistant API routes originating from a single authenticated principal shortly before a crash.
Loss of availability across all Kibana spaces on a single instance while Elasticsearch remains healthy.

Detection Strategies

Alert on Kibana process restarts and non-zero exit codes captured by the service supervisor (systemd, container orchestrator, or process manager).
Correlate authentication events for Observability AI Assistant users with subsequent Kibana log entries containing stack traces or fatal error markers.
Baseline normal request volume to Assistant endpoints and flag anomalous request patterns from low-privileged accounts.

Monitoring Recommendations

Ingest Kibana application logs and process supervisor events into a centralized logging or SIEM platform for correlation.
Track availability metrics for the Kibana HTTP endpoint and pair them with authenticated session telemetry.
Review audit logs for accounts assigned Observability AI Assistant privileges and validate that access aligns with least-privilege policy.

How to Mitigate CVE-2026-72644

Immediate Actions Required

Upgrade Kibana to version 9.4.5, 9.5.1, or later as directed in ESA-2026-115.
Audit user roles and remove Observability AI Assistant feature access from accounts that do not require it.
Configure a process supervisor to automatically restart Kibana after abnormal termination to reduce downtime.

Patch Information

Elastic released fixed builds in Kibana 9.4.5 and 9.5.1. Details are published in the Elastic Security Update ESA-2026-115. Apply the upgrade to every Kibana node in clustered or highly available deployments.

Workarounds

Restrict network access to the Kibana interface so that only trusted users can reach the Observability AI Assistant routes.
Revoke the Observability AI Assistant feature privilege from non-essential roles until the patch is applied.
Deploy multiple Kibana instances behind a load balancer with automatic restart to limit the blast radius of a single crash.

bash

# Verify installed Kibana version before and after patching
/usr/share/kibana/bin/kibana --version

# Example systemd override to auto-restart Kibana on failure
# /etc/systemd/system/kibana.service.d/override.conf
[Service]
Restart=always
RestartSec=5