CVE-2026-49094: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reconfigure Kibana role/permission settings so that viewer-level users are not allowed to submit requests to the analytics collections management endpoint. Require a higher-privilege role for management operations.
Kibana (analytics collections management endpoint) viewer access = disabled - Compensating control
Deploy network-level protections (WAF, reverse proxy, API gateway, or firewall) in front of Kibana to: 1) enforce maximum request body size limits to block oversized inputs, 2) apply rate-limiting on the analytics collections management endpoint, and 3) restrict access to the endpoint to trusted IPs or networks.
- Operational
If Kibana becomes unavailable due to excessive resource consumption, manually recover the service (for example by restarting the Kibana process/service and affected hosts) and monitor CPU/memory until normal operation is restored.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49094?
The severity of CVE-2026-49094 is medium with a score of 6.5.
How does CVE-2026-49094 affect Kibana?
CVE-2026-49094 can lead to denial of service due to uncontrolled resource consumption.
What type of access is required to exploit CVE-2026-49094?
Exploitation of CVE-2026-49094 requires authenticated user access with viewer-level permissions.
How can organizations mitigate CVE-2026-49094?
Organizations can mitigate CVE-2026-49094 by limiting the size of input values for requests to the analytics collections management endpoint.
What is the potential impact of CVE-2026-49094?
The potential impact of CVE-2026-49094 is that it can cause a denial of service that hinders the availability of Kibana.