CVE-2026-78586: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, rendering it unavailable to all users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Kibana user with low-level privileges can exploit it. No user interaction is required.
What is the practical impact of a successful attack?
A specially crafted request can cause Kibana to consume unbounded memory. This can render the Kibana service unavailable to all users; the provided information does not indicate confidentiality or integrity impact.
Is an unauthenticated internet attacker able to exploit this by default?
The provided information describes exploitation by an authenticated user with low-level privileges. It does not establish whether unauthenticated access or any particular default configuration is affected.