CVE-2026-72682: CWE-770 Allocation of Resources Without Limits or Throttling in Elastic Kibana

This vulnerability (CWE-770) in Kibana allows an authenticated user with minimal privileges to submit a crafted request that causes unbounded memory consumption. The excessive allocation leads to termination of the Kibana process, resulting in denial of service to all users of the affected instance. The CVSS 3.1 score is 6.5 (medium), reflecting network attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The affected version is exactly 9.3.0. No patch or official remediation level has been published yet, and no known exploits are reported in the wild.

An attacker with low-level authenticated access can cause Kibana to consume excessive memory, terminating the process and denying service to all users. There is no impact on confidentiality or integrity, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users with Agent Builder privileges and monitor resource usage to detect potential abuse.