Uncaught Exception in Kibana Leading to Denial of Service
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.
Affected Versions:
- 9.x:
- All versions from 9.1.7 up to and including 9.4.4
- Version 9.5.0
Users on the 8.x release line and earlier are not affected. The feature that contains this vulnerability was introduced in Kibana 9.1.7 and is not present in the 8.x release line.
Affected Configurations:
Deployments in which the Observability AI Assistant is available and usable. The Observability AI Assistant requires an Enterprise (or trial) license and a configured generative AI connector. Deployments without a valid license for the feature, or where no user or role can reach the feature, are not exposed.
Solutions and Mitigations:
The issue is resolved in Kibana versions 9.4.5 and 9.5.1.
For Users that Cannot Upgrade:
Set the aiAssistant:preferredAIAssistantType advanced setting so that the AI Assistants are not shown anywhere. Alternatively, remove the Observability AI Assistant feature privilege from all custom Kibana roles, and avoid granting base privileges that include it. Both options remove AI Assistant functionality for the affected users.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72644
Problem Type: CWE-248 - Uncaught Exception
Impact: CAPEC-153 - Input Data Manipulation