CVEvulnerability

CVE-2026-72660

6.5 MEDIUM Published 2026-08-13 Modified 2026-09-02 Official page ↗
Status
Analyzed
Published
2026-08-13
Last modified
2026-09-02
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248

Description

Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

Affected configurations

• elastic kibana (>= 8.0.0 < 8.19.20) • elastic kibana (>= 9.0.0 < 9.3.8) • elastic kibana (>= 9.4.0 < 9.4.5)

Related

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References