SB2026090167 - Multiple vulnerabilities in Kibana

Description

This security bulletin contains information about 2 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-72652)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Timeline feature when handling a specially crafted request. A remote user can submit a specially crafted request to cause a denial of service.

Only Kibana deployments that use the Timeline feature are vulnerable.

2) Path traversal (CVE-ID: CVE-2026-78592)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to delete privileged resources.

The vulnerability exists due to path traversal in the tag management interface when an administrator interacts with attacker-controlled tag data. A remote user can create a crafted tag to cause a subsequent administrative action to delete privileged resources.

Exploitation requires the attacker to have tag creation privileges, and an administrator must interact with the affected interface.

Remediation

Install update from vendor's website.

References

• https://discuss.elastic.co/t/kibana-8-19-19-9-3-5-security-update-esa-2026-48/390085
• https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077