CVE-2026-72644 — Uncaught Exception in Kibana Leading to Denial of Service

CVE-2026-72644

Uncaught Exception in Kibana Leading to Denial of Service PUBLISHED

Description (CNA)

Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error condition, terminating the Kibana process and denying service to all users and spaces on that instance until it is restarted.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.1.7 through 9.4.4; affected 9.5.0

CWE

CWE-248

References

https://discuss.elastic.co/t/kibana-9-4-5-9-5-1-security-update-esa-2026-115/390088

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.