Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only low, read-level Agent Builder privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, terminating the process and denying service to all users of the instance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T20:17:17.227Z",
  "pubdate": "2026-09-01T20:17:17.227Z",
  "executiveSummary": "This vulnerability involves an Allocation of Resources Without Limits or Throttling issue (CWE-770) within the Kibana platform. The flaw enables an attacker to trigger an Excessive Allocation (CAPEC-130) of memory, resulting in a Denial-of-Service (DoS) condition. The vulnerability is exploitable by an authenticated user possessing minimal 'Agent Builder' privileges, allowing the individual to consume unbounded memory resources until the Kibana process terminates. This failure effectively renders the service unavailable to all authorized users, representing a significant risk to system availability and continuity. The lack of input validation or resource constraints during specific request processing allows this memory pressure to be induced, as the application fails to enforce necessary limits on resource utilization for authenticated low-privilege sessions.",
  "technicalDetails": "The vulnerability resides in the request handling logic within Kibana, where improper management of resource allocation occurs during the processing of crafted requests initiated by users with Agent Builder privileges. Specifically, the system fails to implement sufficient throttling or upper bounds on memory consumption when handling certain inputs, violating the principles of resource safety as defined in CWE-770.\nThe attack flow commences with an authenticated attacker, operating with read-level Agent Builder permissions, submitting a maliciously crafted request to the Kibana interface. Upon receipt, the application component responsible for parsing or executing the associated task fails to validate the scope or the potential memory footprint of the request parameters. Consequently, the component enters a state of uncontrolled memory allocation, attempting to fulfill the request by ballooning its heap usage.\nBecause there are no integrated limiters or circuit breakers to monitor or restrict these allocations, the process continues to consume memory at an exponential rate. This eventually exhausts the available system memory (RAM) or reaches the threshold configured for the Kibana process, causing the Node.js runtime environment to crash due to an 'Out of Memory' (OOM) error or causing the operating system to terminate the process to prevent system-wide instability. The immediate impact of this exploitation is a complete service disruption, where all functionality, dashboards, and management capabilities provided by Kibana become unreachable for the duration of the process downtime or until manual intervention restores the service.\nThe exploit leverages the inherent trust placed in authenticated users and the absence of granular rate limiting or resource quotas per session. By bypassing standard sanity checks on requested resource sizes, the attacker forces the application into a fatal state without requiring administrative or elevated privileges, thus widening the attack surface to any authenticated user account. The failure manifests as a resource exhaustion vector that is straightforward to trigger, provided the attacker can reach the specific endpoint capable of initiating the resource-heavy operation. This vulnerability illustrates a critical design flaw in how the platform manages transient memory requirements, suggesting a lack of backpressure mechanisms in the request-handling pipeline."
}