CVE-2026-72644
Last modified
CVE-2026-72644 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | >= 9.1.7, < 9.4.5 |
| Elastic | Kibana | 9.5.0 |
References
- https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-72644?
How severe is CVE-2026-72644?
How do I fix CVE-2026-72644?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-72639Elasticsearch does not enforce an upper bound on a user-supp…6.5
- CVE-2026-7264A weakness has been identified in SourceCodester Pizzafy Eco…6.3
- CVE-2026-72640The Elastic Cloud on Kubernetes (ECK) operator reads a list …6.5
- CVE-2026-72641Incorrect Authorization (CWE-863) in Kibana can lead to unau…5.4
- CVE-2026-72642The native inference process that Elasticsearch uses to eval…8.8
- CVE-2026-72643Kibana Agent Builder determines whether a caller owns a priv…7.1
- CVE-2026-72645Memory Allocation with Excessive Size Value (CWE-789) in Ela…6.5
- CVE-2026-72647Uncontrolled Recursion (CWE-674) in Elasticsearch can lead t…6.5
- CVE-2026-72648Cleartext Storage of Sensitive Information in an Environment…6.5
- CVE-2026-72649Deserialization of Untrusted Data (CWE-502) in the Elasticse…8.8
- CVE-2026-7265A security vulnerability has been detected in SourceCodester…6.3
- CVE-2026-72650Authorization Bypass Through User-Controlled Key (CWE-639) i…4.3
Are you affected by CVE-2026-72644?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST