CVE-2026-72682: Elastic Kibana DOS Vulnerability

CVE-2026-72682 Overview

CVE-2026-72682 is a denial-of-service vulnerability in Elastic Kibana caused by unbounded resource allocation in the Agent Builder feature. An authenticated user with only low, read-level Agent Builder privileges can submit a crafted request that forces Kibana to allocate unlimited memory. The Kibana process is terminated by the operating system, denying service to every user of the instance. The flaw is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling) and maps to CAPEC-130 (Excessive Allocation). Elastic addressed the issue in Kibana 9.4.6 through security advisory ESA-2026-84.

Critical Impact
A low-privileged authenticated user can crash the entire Kibana instance, causing full loss of availability for all users of the affected deployment.

Affected Products

Elastic Kibana (versions prior to 9.4.6)
Kibana deployments exposing the Agent Builder feature
Self-managed and Elastic Cloud Kibana instances running vulnerable builds

Discovery Timeline

2026-09-01 - CVE-2026-72682 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-72682

Vulnerability Analysis

The vulnerability resides in the Agent Builder component of Kibana. The affected code path processes input from an authenticated API caller without enforcing bounds on the size, depth, or count of allocated objects. When the crafted request is processed, Kibana's Node.js runtime attempts to satisfy the allocation until the process exceeds available heap or system memory. The runtime then terminates, taking down the shared Kibana instance and disrupting dashboards, alerting, and query workflows for all connected users.

Exploitation requires only low, read-level Agent Builder privileges. Any account authorized to invoke the vulnerable Agent Builder endpoint can trigger the condition, which lowers the practical barrier in multi-tenant or analyst-heavy deployments.

Root Cause

The root cause is missing input validation and missing resource caps on an Agent Builder request handler. The handler does not enforce upper bounds on request-driven memory allocation before invoking allocation routines. Because Kibana runs as a single Node.js process serving all tenants, memory exhaustion in one request path crashes the entire service.

Attack Vector

The attack vector is network-based and authenticated. An attacker with valid credentials and the read-level Agent Builder role sends a single specially crafted HTTP request to a vulnerable Kibana endpoint. The request causes the process to allocate memory without limit, leading to termination by the Node.js runtime or the host operating system. No user interaction and no elevated privileges are required. Refer to the Elastic Security Update ESA-2026-84 for vendor-supplied technical detail.

// No verified proof-of-concept code is published for this CVE.
// See Elastic advisory ESA-2026-84 for technical detail.

Detection Methods for CVE-2026-72682

Indicators of Compromise

Unexpected Kibana process termination with out-of-memory or heap allocation errors in kibana.log
Sudden spikes in resident memory usage on Kibana hosts followed by service restart events
Repeated 503 or connection-reset responses returned to Kibana clients around the time of the crash
Agent Builder API requests originating from low-privilege accounts immediately preceding a crash

Detection Strategies

Alert on Kibana process exits and container restarts correlated with Node.js JavaScript heap out of memory messages
Baseline normal Agent Builder request sizes and flag statistical outliers in request payload size or complexity
Correlate authentication logs with Agent Builder endpoint access to identify low-privilege accounts issuing unusual requests

Monitoring Recommendations

Monitor Kibana host memory utilization and set thresholds that fire before OOM termination occurs
Ship Kibana audit logs and process supervisor events to a central logging platform for correlation
Track API call rates per user against Agent Builder endpoints and rate-limit anomalous behavior

How to Mitigate CVE-2026-72682

Immediate Actions Required

Upgrade Kibana to version 9.4.6 or later as directed in ESA-2026-84
Inventory all Kibana instances and identify which run vulnerable versions with Agent Builder enabled
Audit accounts that hold Agent Builder read-level privileges and remove entitlements that are not required
Restart the Kibana service after patching to clear any residual state

Patch Information

Elastic released a fix in Kibana 9.4.6. Details are published in the Elastic Security Update ESA-2026-84. Elastic Cloud users should confirm the deployment has been upgraded to a patched build.

Workarounds

Restrict network access to Kibana so only trusted analyst networks can reach the Agent Builder endpoints
Revoke Agent Builder privileges from users who do not require the feature until the patch is applied
Place a reverse proxy in front of Kibana that enforces request size limits and per-user rate limiting
Run Kibana with memory limits and automatic restart policies to reduce the duration of any successful DoS

bash

# Example: verify Kibana version after upgrade
curl -s -u <user>:<pass> https://kibana.example.com/api/status | jq '.version.number'

# Example: enforce per-connection request size cap at the proxy (nginx)
# client_max_body_size 1m;