CVE-2026-72667

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat.

• CWE-770

• https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-98/389516Vendor Advisory

Published

Aug 13, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72660Uncaught Exception (CWE-248), resulting from Improper Input …6.5
• CVE-2026-72661Missing Authorization (CWE-862) in Kibana can lead to inform…6.5
• CVE-2026-72663Inefficient Algorithmic Complexity (CWE-407) in Kibana can l…6.5
• CVE-2026-72664Missing Authorization (CWE-862) in Kibana can lead to unauth…6.5
• CVE-2026-72665Missing Authorization (CWE-862) in Kibana can lead to unauth…8.1
• CVE-2026-72666Authorization Bypass Through User-Controlled Key (CWE-639) i…6.8
• CVE-2026-72669The state that Kibana stores for an Observability Onboarding…7.6
• CVE-2026-7267A flaw has been found in SourceCodester Pizzafy Ecommerce Sy…6.3
• CVE-2026-72670A lower privileged user who holds only the privilege to read…6.5
• CVE-2026-72671A Kibana Machine Learning capability that removes a saved ob…4.3
• CVE-2026-72672The Elastic Security capability that suggests existing field…7.7
• CVE-2026-72673Incorrect Authorization (CWE-863) in Kibana can lead to unau…5.4