CVE-2026-0543: Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0543?
CVE-2026-0543 is classified as a moderate severity vulnerability due to improper input validation in Kibana's Email Connector.
How do I fix CVE-2026-0543?
To remediate CVE-2026-0543, update Kibana to the latest version where the vulnerability has been addressed.
What type of attack can exploit CVE-2026-0543?
CVE-2026-0543 can be exploited via a specially crafted email address parameter, leading to excessive memory allocation.
In which version of Kibana is CVE-2026-0543 present?
CVE-2026-0543 affects certain versions of Elastic Kibana that have not been updated to the latest security patches.
What does improper input validation mean in the context of CVE-2026-0543?
Improper input validation in CVE-2026-0543 refers to the failure of Kibana to adequately check the format and length of email address inputs, allowing for malicious input.