CVE-2026-49089
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Allocation of resources without limits or throttling in Kibana can lead to denial of service via excessive allocation. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.
Risk Assessment
A single request from a read-only user can completely disable Kibana, causing prolonged denial of service for all users. This can lead to significant downtime and unavailability of analytical tools.
Recommendation
Install the Kibana patch that introduces limits on query expression sizes. Restrict access to connector reporting operations to trusted users and consider monitoring for unusual requests.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.