What is CVE-2026-72653?

CVE-2026-72653 is a medium-severity vulnerability in Elastic Kibana, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-08-13.

How severe is CVE-2026-72653?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Resource exhaustion in Elastic Kibana

CVE-2026-72653

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is authorized to manage maintenance windows could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. Kibana becomes unresponsive for all users and does not recover without manual intervention.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Elastic Kibana — versions 8.12.0, 9.0.0, 9.4.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security@elastic.co

Frequently asked questions

What is CVE-2026-72653?: CVE-2026-72653 is a medium-severity vulnerability in Elastic Kibana, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2026-08-13.
How severe is CVE-2026-72653?: Medium severity. CVSS v3 base score is 6.5 out of 10.