Elk: Uncaught Exception in Kibana Leading to Denial of Service (CVE-2026-72660)
CVE-2026-72660 is a vulnerability in Kibana where an uncaught exception caused by improper input validation can lead to a denial of service. An authenticated user with low privileges can supply specially crafted data that triggers an internal error, causing the Kibana process to terminate. This results in service unavailability until the system is restarted. The issue affects multiple Kibana versions prior to specific fixed releases. No known exploits are reported in the wild, and a patch is available.
AI Analysis
Technical Summary
This vulnerability in Kibana arises from improper input validation that allows an authenticated low-privileged user to cause an uncaught exception by sending specially crafted input data. The exception terminates the Kibana process, leading to denial of service for all users until the service is manually restarted. The flaw affects Kibana versions >=8.0.0 <8.19.20, >=9.0.0 <9.3.8, and >=9.4.0 <9.4.5. No CVSS score is provided, but the impact is a medium severity denial of service condition. No known exploits have been reported.
Potential Impact
An attacker with low-privileged authenticated access can cause the Kibana service to crash by triggering an uncaught exception through crafted input. This results in denial of service for all users until the service is restarted. The condition can be repeatedly triggered, potentially causing persistent downtime.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.20 or later, 9.3.8 or later, and 9.4.5 or later as applicable. Since this is not a cloud service, administrators must apply the update manually to remediate the issue.
Elk: Uncaught Exception in Kibana Leading to Denial of Service (CVE-2026-72660)
Description
CVE-2026-72660 is a vulnerability in Kibana where an uncaught exception caused by improper input validation can lead to a denial of service. An authenticated user with low privileges can supply specially crafted data that triggers an internal error, causing the Kibana process to terminate. This results in service unavailability until the system is restarted. The issue affects multiple Kibana versions prior to specific fixed releases. No known exploits are reported in the wild, and a patch is available.
Affected software
pkg:bitnami/kibanaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Kibana arises from improper input validation that allows an authenticated low-privileged user to cause an uncaught exception by sending specially crafted input data. The exception terminates the Kibana process, leading to denial of service for all users until the service is manually restarted. The flaw affects Kibana versions >=8.0.0 <8.19.20, >=9.0.0 <9.3.8, and >=9.4.0 <9.4.5. No CVSS score is provided, but the impact is a medium severity denial of service condition. No known exploits have been reported.
Potential Impact
An attacker with low-privileged authenticated access can cause the Kibana service to crash by triggering an uncaught exception through crafted input. This results in denial of service for all users until the service is restarted. The condition can be repeatedly triggered, potentially causing persistent downtime.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.20 or later, 9.3.8 or later, and 9.4.5 or later as applicable. Since this is not a cloud service, administrators must apply the update manually to remediate the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-kibana-2026-72660
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-72660"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Threat ID: 6a85b4aaacd9273b49250f00
Added to database: 08/19/2026, 13:50:34 UTC
Last enriched: 08/19/2026, 14:04:20 UTC
Last updated: 08/19/2026, 18:52:00 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.