CVE-2026-72660

MediumCVSS 6.5/10Last modified Sep 2, 2026

Description

Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged access can cause an internal error condition in Kibana by supplying specially crafted data. The resulting error is raised on an execution path so it propagates as an uncaught exception and terminates the Kibana process. Kibana is unavailable to all users until the service is restarted, and the condition can be triggered repeatedly.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Sep 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-726616.5Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (C CVE-2026-726626.3Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data CVE-2026-726636.5Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially cr CVE-2026-726646.5Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessi CVE-2026-726658.1Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts CVE-2026-726666.8Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that ar CVE-2026-726676.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130 CVE-2026-726687.3Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrativ CVE-2026-726697.6The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read an CVE-2026-72676.3A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This mani CVE-2026-726706.5A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. T CVE-2026-726714.3A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target,