CVE-2026-72674
published 2026-08-13CVE-2026-72674: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
35.2th percentile
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 9.3.0 < 9.3.8 | 9.3.8 |
| elastic | kibana | 9.3.0 – 9.3.7 | — |
| elastic | kibana | >= 9.4.0 < 9.4.4 | 9.4.4 |
| elastic | kibana | 9.4.0 – 9.4.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 9.3.7/9.4.3 Playground for RAG feature allocation of resources (EUVD-2026-58261)
vuldb·2026-08-13·CVSS 6.5
CVE-2026-72674 [MEDIUM] Elastic Kibana up to 9.3.7/9.4.3 Playground for RAG feature allocation of resources (EUVD-2026-58261)
A vulnerability described as problematic has been identified in Elastic Kibana up to 9.3.7/9.4.3. This affects an unknown part of the component Playground for RAG feature. Executing a manipulation can lead to allocation of resources.
This vulnerability is tracked as CVE-2026-72674. The attack can be launched remotely. No exploit exists.
GHSA
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-08-13
CVE-2026-72674 [MEDIUM] CWE-770 Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published