CVE-2026-72652: Elastic Kibana DOS Vulnerability

CVE-2026-72652 Overview

CVE-2026-72652 is a denial of service vulnerability in Elastic Kibana caused by improper resource allocation controls (CWE-770). An authenticated user can submit a specially crafted request that triggers excessive resource consumption on the server. The condition can render Kibana unavailable to legitimate users. Elastic published the fix in the 8.19.19 and 9.3.5 releases through advisory ESA-2026-48.

Critical Impact

Authenticated attackers can exhaust Kibana server resources with a single crafted request, disrupting monitoring, alerting, and analytics workflows that depend on the platform.

Affected Products

• Elastic Kibana versions prior to 8.19.19
• Elastic Kibana versions prior to 9.3.5
• Deployments exposing authenticated Kibana APIs to internal or federated users

Discovery Timeline

• 2026-09-01 - CVE-2026-72652 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-72652

Vulnerability Analysis

The flaw resides in a Kibana request handler that allocates resources without enforcing size, rate, or complexity ceilings. An authenticated caller can shape a request whose processing forces the server to allocate memory, CPU, or connection resources beyond safe operating thresholds. Sustained or repeated requests cause the Node.js process backing Kibana to become unresponsive or crash.

The attack pattern maps to CAPEC-130 (Excessive Allocation). It requires low privileges and no user interaction, and it targets availability only. Confidentiality and integrity of stored data remain intact. However, dashboards, alerts, and downstream automations that rely on Kibana lose visibility during the disruption.

Root Cause

The root cause is the absence of throttling and input-size validation on a code path reachable by authenticated users. Kibana accepts request parameters that scale allocation behavior linearly or worse without a corresponding upper bound. The service continues processing until process or system limits are reached.

Attack Vector

Exploitation is remote over the network and requires valid Kibana credentials at any authenticated role. The attacker sends a crafted HTTP request to the vulnerable endpoint. No additional interaction from administrators or other users is needed. Details of the specific endpoint and parameters were withheld by Elastic in the ESA-2026-48 advisory pending broad patch adoption.

The vulnerability manifests when the handler processes unbounded input. See the Elastic advisory for the endpoint identification once vendor details are released.

Detection Methods for CVE-2026-72652

Indicators of Compromise

• Sudden spikes in Kibana process memory or CPU consumption without a corresponding increase in user activity.
• Kibana worker restarts, out of memory errors in kibana.log, or 5xx responses to routine API calls.
• Authenticated requests from a single account to the same endpoint at abnormal payload sizes or frequencies.

Detection Strategies

• Baseline request-size and response-time metrics per Kibana API route and alert on statistical outliers.
• Correlate authentication logs with resource utilization to identify accounts that precede performance degradation.
• Inspect reverse proxy or load balancer logs for unusually large request bodies directed at Kibana endpoints.

Monitoring Recommendations

• Enable Kibana audit logging and forward events to a centralized SIEM for correlation with host telemetry.
• Track Node.js heap size, event loop lag, and garbage collection frequency on Kibana hosts.
• Alert on repeated HTTP 503 or gateway timeout responses returned by Kibana to upstream clients.

How to Mitigate CVE-2026-72652

Immediate Actions Required

• Upgrade Kibana to version 8.19.19 or 9.3.5 as documented in Elastic Security Update ESA-2026-48.
• Audit Kibana user accounts and revoke credentials that are unused, shared, or over-privileged.
• Restrict network access to Kibana so that only trusted client ranges can reach authenticated endpoints.

Patch Information

Elastic released fixed builds in Kibana 8.19.19 and 9.3.5. Operators running Elastic Cloud managed deployments receive the patch through the standard upgrade path. Self-managed deployments should follow the vendor upgrade procedure and validate cluster health after upgrade.

Workarounds

• Place Kibana behind a reverse proxy that enforces request body size caps and per-user rate limits.
• Reduce role privileges so that only accounts requiring interactive Kibana access retain authentication rights.
• Configure operating system cgroup or container memory limits to contain resource exhaustion to a single instance.

# Example NGINX reverse proxy hardening in front of Kibana
http {
    limit_req_zone $binary_remote_addr zone=kibana_rl:10m rate=20r/s;
    client_max_body_size 1m;

    server {
        listen 443 ssl;
        server_name kibana.example.com;

        location / {
            limit_req zone=kibana_rl burst=40 nodelay;
            proxy_read_timeout 30s;
            proxy_pass http://kibana_upstream;
        }
    }
}