CVE-2026-72644: Uncaught Exception in Kibana Leading to Denial of Service
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with only the low-privileged feature access needed to use the Observability AI Assistant can trigger it. No broader administrative privileges are described.
What is required to trigger the denial of service?
The attacker must submit a specially crafted request through the Observability AI Assistant functionality. The request causes an unhandled error condition that terminates the Kibana process.
What is the operational impact after exploitation?
Kibana becomes unavailable to all users and spaces on the affected instance. Service remains denied until the Kibana process is restarted.