Uncaught Exception in Kibana Leading to Denial of Service
Description:
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.19
- 9.x:
- All versions from 9.0.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.4
Affected Configurations:
All configurations are affected. The vulnerability is present in the Kibana Security Solution feature set, which is enabled by default in self-managed and Elastic Cloud Hosted deployments. Exploitation requires an authenticated Kibana account with read access and the ability to write documents to at least one Elasticsearch index that Kibana subsequently reads.
Solutions and Mitigations:
The issue is resolved in versions 8.19.20, 9.3.8, 9.4.5.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72660
Problem Type: CWE-248 - Uncaught Exception
Impact: CAPEC-153 - Input Data Manipulation