CVE-2026-72660: Uncaught Exception in Kibana Leading to Denial of Service
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72660?
CVE-2026-72660 has a medium severity rating of 6.5.
How can I fix CVE-2026-72660?
To address CVE-2026-72660, upgrade to the latest version of Kibana that includes the necessary security updates.
What impact does CVE-2026-72660 have on my Kibana setup?
CVE-2026-72660 can lead to a denial of service condition affecting the availability of your Kibana instance.
Who can exploit CVE-2026-72660?
An authenticated user with low-privileged access can exploit CVE-2026-72660 by manipulating input data.
What causes the vulnerability defined by CVE-2026-72660?
CVE-2026-72660 is caused by an uncaught exception resulting from improper input validation in Kibana.