CVE-2026-94400: Elastic Kibana DOS Vulnerability

CVE-2026-94400 Overview

CVE-2026-94400 is an uncontrolled resource consumption vulnerability [CWE-400] in Elastic Kibana. An authenticated attacker with low privileges can trigger excessive memory or CPU allocation (CAPEC-130), causing a denial-of-service condition against the Kibana instance. The flaw affects the availability of the service without impacting confidentiality or integrity. Elastic addressed the issue in Kibana 8.19.22, 9.4.7, and 9.5.3 under advisory ESA-2026-181.

Critical Impact
Authenticated users can exhaust Kibana server resources, rendering the dashboard and search interface unavailable to legitimate users and disrupting downstream security monitoring and observability workflows.

Affected Products

Elastic Kibana versions prior to 8.19.22
Elastic Kibana 9.x versions prior to 9.4.7
Elastic Kibana 9.5.x versions prior to 9.5.3

Discovery Timeline

2026-09-26 - CVE-2026-94400 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-94400

Vulnerability Analysis

The vulnerability resides in Kibana's handling of specific requests that trigger disproportionate resource allocation on the server. An attacker who holds a valid Kibana account can submit crafted requests that cause the backend process to consume excessive memory or CPU cycles. The result is service degradation or a full outage of the Kibana user interface and its API endpoints.

Because Kibana often serves as the primary analytics and visualization layer for Elasticsearch deployments, downtime affects security operations teams, observability engineers, and business users who depend on dashboards. The attack vector is network-based and requires low attack complexity.

Root Cause

The underlying weakness is improper control of resource allocation during request processing [CWE-400]. Kibana fails to enforce sufficient bounds on operations that scale with user-supplied input, allowing a single authenticated session to consume shared server capacity disproportionate to the request size.

Attack Vector

Exploitation requires network access to the Kibana HTTP interface and a valid low-privilege account. The attacker issues one or more requests designed to maximize server-side allocation. Repeated or parallel issuance amplifies the impact, saturating the Node.js runtime that hosts Kibana and preventing legitimate requests from completing.

No public proof-of-concept code is available at the time of publication. Technical specifics are described in the Elastic advisory. See the Elastic Security Update ESA-2026-181 for additional details.

Detection Methods for CVE-2026-94400

Indicators of Compromise

Sudden spikes in Kibana Node.js process memory or CPU utilization without a corresponding increase in legitimate dashboard traffic.
Repeated HTTP 503 or timeout responses from Kibana endpoints followed by process restarts by the service manager.
Authenticated requests from a single low-privilege account issuing high-volume or unusually large query payloads.

Detection Strategies

Baseline normal Kibana API request patterns per user and alert on deviations in request size, frequency, or response latency.
Monitor Kibana server logs for repeated out-of-memory errors, event loop blocking warnings, or request handler timeouts.
Correlate Kibana audit logs with reverse proxy or load balancer metrics to identify a single session responsible for resource spikes.

Monitoring Recommendations

Forward Kibana server logs and audit logs to a centralized SIEM for query-based identification of abnormal request patterns.
Instrument the Kibana host with resource telemetry covering heap usage, event loop lag, and request queue depth.
Alert on process restarts of the Kibana service and track mean time between failures as a leading indicator.

How to Mitigate CVE-2026-94400

Immediate Actions Required

Upgrade Kibana to version 8.19.22, 9.4.7, or 9.5.3 or later, matching your current major release line.
Audit Kibana user accounts and remove or disable unused low-privilege accounts that could be abused to trigger the flaw.
Enforce strong authentication and rotate credentials for any accounts suspected of compromise.

Patch Information

Elastic released fixed builds in Kibana 8.19.22, 9.4.7, and 9.5.3 under advisory ESA-2026-181. Review the Elastic Security Update ESA-2026-181 for upgrade guidance and release notes. Apply the update to all Kibana nodes in a clustered deployment to ensure consistent protection.

Workarounds

Place Kibana behind a reverse proxy that enforces per-user rate limits and request size caps until patches are applied.
Restrict network access to the Kibana HTTP interface so that only trusted administrative networks can reach the service.
Configure process-level resource limits (for example, container memory limits or systemd constraints) to contain impact and enable automatic recovery.

bash

# Example: restrict Kibana container memory and enforce proxy rate limits
# docker run flag to cap Kibana memory
docker run --memory=4g --memory-swap=4g docker.elastic.co/kibana/kibana:8.19.22

# nginx reverse proxy snippet: limit requests per authenticated session
limit_req_zone $http_authorization zone=kibana_auth:10m rate=20r/s;
server {
    location / {
        limit_req zone=kibana_auth burst=40 nodelay;
        client_max_body_size 1m;
        proxy_pass http://kibana_backend;
    }
}