CVEvulnerability

CVE-2026-0531

6.5 MEDIUM Published 2026-01-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.

Affected configurations

• elastic kibana (>= 7.10.0 < 7.17.29) • elastic kibana (>= 8.0.0 < 8.19.10) • elastic kibana (>= 9.0.0 < 9.1.10) • elastic kibana (>= 9.2.0 < 9.2.4)

Related

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References