CVE-2026-78586: CWE-770 Allocation of Resources Without Limits or Throttling in Elastic Kibana

This vulnerability (CWE-770) in Elastic Kibana allows an authenticated user with low-level privileges to trigger excessive memory allocation by submitting specially crafted requests. This lack of resource allocation limits or throttling can cause a denial of service condition by exhausting system memory, rendering Kibana unavailable to all users. The issue affects versions 8.0.0, 9.0.0, and 9.4.0. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

An attacker with low-level authenticated access can cause Kibana to consume unbounded memory resources, leading to denial of service and unavailability of the Kibana service for all users. There is no impact on confidentiality or integrity according to the CVSS vector. The denial of service impact is rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for unusual memory consumption and restrict access to trusted users. No official remediation or temporary fix has been published by Elastic at this time.