CVE-2026-78586: Kibana Memory Exhaustion DOS Vulnerability

CVE-2026-78586 Overview

CVE-2026-78586 is a denial of service vulnerability in Elastic Kibana caused by allocation of resources without limits or throttling [CWE-770]. An authenticated user holding only low-level privileges can submit a specially crafted request that forces Kibana to consume unbounded memory. The resulting resource exhaustion renders the Kibana instance unavailable to all users. Elastic addressed the issue in Kibana versions 8.19.16, 9.3.5, and 9.4.2 under advisory ESA-2026-163.

Critical Impact
Any authenticated Kibana user with minimal privileges can trigger a full service outage across the deployment, disrupting monitoring, alerting, and observability workflows that depend on Kibana.

Affected Products

Elastic Kibana versions prior to 8.19.16
Elastic Kibana 9.x versions prior to 9.3.5
Elastic Kibana 9.4.x versions prior to 9.4.2

Discovery Timeline

2026-09-02 - CVE-2026-78586 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78586

Vulnerability Analysis

The flaw sits in a Kibana request-handling path that accepts user-supplied parameters and allocates memory proportional to those inputs. The code path lacks upper bounds, quotas, or throttling on the size of the allocated structures. As a result, a single crafted request can drive the Node.js process into memory pressure, garbage collection thrashing, and eventual out-of-memory termination.

Because Kibana runs as a single-process front end to Elasticsearch, exhausting its heap denies service to every user of the instance. Availability is the sole impacted property; confidentiality and integrity are not affected. Recovery typically requires operator intervention to restart the Kibana service.

Root Cause

The root cause is missing input validation and resource governance on an authenticated API endpoint. Kibana trusts the shape and size of parameters supplied by authenticated callers and allocates buffers or in-memory objects accordingly. Without a maximum bound or rate limit, the endpoint scales linearly with attacker-controlled input, which maps directly to CWE-770 (Allocation of Resources Without Limits or Throttling).

Attack Vector

Exploitation requires network access to Kibana and valid credentials with low privileges. No user interaction is required, and attack complexity is low. An authenticated attacker sends a specially crafted request over the standard HTTP or HTTPS interface. The request pattern aligns with CAPEC-130 (Excessive Allocation): the attacker manipulates parameters that Kibana uses to size internal allocations, causing memory consumption to grow without bound until the process fails.

Because any authenticated account is sufficient, credential compromise, insider misuse, or over-provisioned service accounts all provide a viable path to trigger the condition. See the Elastic Security Update Discussion for vendor detail.

Detection Methods for CVE-2026-78586

Indicators of Compromise

Kibana process restarts or OutOfMemoryError entries in Kibana logs correlated with authenticated API calls.
Sudden spikes in Kibana Node.js resident set size (RSS) or heap usage without a corresponding increase in legitimate user activity.
Repeated requests from a single authenticated principal to the same Kibana endpoint immediately preceding a service outage.
HTTP 5xx responses or connection resets from Kibana coinciding with elevated memory metrics.

Detection Strategies

Baseline normal Kibana heap and CPU utilization, then alert on deviations that exceed the baseline for sustained intervals.
Correlate Kibana audit logs with process telemetry to attribute memory spikes to specific users, API paths, and request payload sizes.
Hunt for anomalously large request bodies or unusual query parameter values sent to Kibana APIs by low-privilege accounts.

Monitoring Recommendations

Ingest Kibana audit logs, process metrics, and reverse-proxy access logs into a centralized analytics platform for correlation.
Configure alerts on Kibana service restarts, high memory pressure, and repeated failed health checks.
Track authentication events and API usage per user to identify low-privilege accounts issuing atypical request volumes.

How to Mitigate CVE-2026-78586

Immediate Actions Required

Upgrade Kibana to 8.19.16, 9.3.5, or 9.4.2 or later as documented in advisory ESA-2026-163.
Audit Kibana user accounts and revoke unused or over-privileged credentials, especially service accounts with API access.
Restrict network exposure of Kibana to trusted management networks and enforce authentication at an upstream reverse proxy.
Enable resource limits on the host or container running Kibana so that a single crash does not cascade to co-located services.

Patch Information

Elastic released fixed builds in Kibana 8.19.16, 9.3.5, and 9.4.2. Details are available in the Elastic Security Update Discussion for ESA-2026-163. Apply the update on all Kibana nodes in the cluster and verify version reporting after restart.

Workarounds

Place Kibana behind a reverse proxy that enforces request size limits and per-user rate limiting until patching is complete.
Reduce the blast radius by tightening role-based access control so that only vetted users can authenticate to Kibana.
Configure container or systemd memory limits and automatic restart policies to shorten outages if the endpoint is triggered.

bash

# Example NGINX reverse proxy hardening in front of Kibana
http {
    limit_req_zone $binary_remote_addr zone=kibana_rl:10m rate=20r/s;
    client_max_body_size 1m;

    server {
        listen 443 ssl;
        server_name kibana.example.com;

        location / {
            limit_req zone=kibana_rl burst=40 nodelay;
            proxy_pass http://kibana_upstream;
            proxy_read_timeout 30s;
        }
    }
}