CVE-2026-49087: Kibana Denial of Service via Bulk Deletion Resource Exhaustion

Technical summary

This vulnerability stems from insufficient resource throttling in Kibana's bulk deletion functionality (CWE-770: Allocation of Resources Without Limits or Throttling). An authenticated attacker can craft a bulk deletion request that triggers excessive resource allocation—typically memory or CPU—without triggering protective limits. The vulnerability follows CAPEC-130 (Excessive Allocation), a well-established attack pattern. The CVSS 3.1 score of 6.5 (MEDIUM) reflects that while availability impact is high, exploitation requires prior authentication and does not affect confidentiality or integrity.

Business impact

A successful attack renders Kibana unavailable, disrupting logging, monitoring, and observability operations that security teams and operators depend on for real-time threat detection, incident response, and system health visibility. In environments where Kibana is mission-critical, even brief downtime can delay incident detection and response. The impact is operational availability rather than data breach, but loss of monitoring capability during an attack is a significant tactical handicap.

Affected systems

Kibana is the primary affected product. The vulnerability requires authentication, so it applies to all Kibana deployments where users have active accounts. Organizations running Kibana as part of the Elastic Stack should assume their instances are at risk unless they are running a patched version. Verify specific affected versions against Elastic's security advisory.

Exploitability

Exploitability is moderate. The attack requires valid Kibana credentials, which raises the barrier compared to unauthenticated exploits. However, once credentials are obtained—through phishing, insider access, or credential reuse—the attack is trivial to execute and does not require special tools or timing. No user interaction is needed beyond crafting and submitting the malicious request. The attack is neither in the CISA KEV catalog nor currently known to be exploited in the wild, but the simplicity of execution means it should be treated as a credible risk if credential compromise occurs.

Remediation

Patch Kibana to the version specified in Elastic's security advisory. In the interim, apply the principle of least privilege to Kibana user accounts—limit bulk deletion permissions to users who genuinely require them, and monitor bulk deletion operations for anomalous patterns (unusually large requests, repeated failures, or requests from unexpected users). If feasible, isolate Kibana behind a WAF or API gateway that can throttle bulk requests.

Patch guidance

Consult Elastic's official security advisory for the specific patched version. Once a patch is released, prioritize deployment in your production Kibana instances, starting with those handling the highest volume of monitoring data. Test patches in a non-production environment first, as Kibana updates may require Elasticsearch compatibility verification. Verify that your patches have been applied by checking Kibana's version endpoint and cross-referencing against the patched version list in the advisory.

Detection guidance

Monitor Kibana application logs and resource utilization metrics for indicators of a bulk deletion attack: sudden spikes in memory or CPU consumption immediately following bulk deletion API calls, unusually large DELETE requests to the bulk endpoint, or multiple bulk deletion requests from a single user in a short time window. If available, enable audit logging in Kibana to track which users performed bulk operations. Watch for failed requests that coincide with performance degradation, as the attacker may trigger errors that still consume resources. Network-level detection is difficult because the request is legitimate (bulk deletion is a normal operation); focus on anomaly detection at the application level.

Why prioritize this

Prioritize patching within 30–45 days depending on your threat model. Although the CVSS score is MEDIUM and the vulnerability is not yet in active exploitation, the ease of execution, low barrier to entry (any authenticated user), and direct impact on security monitoring operations make it a meaningful tactical risk. Organizations with tight credential controls or strong insider-threat programs can justify longer timelines; those with higher rates of credential compromise or more permissive bulk deletion access should accelerate patching.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a combination of factors: (1) high availability impact—the attack directly causes denial of service; (2) low barrier to access—network-accessible, no special privileges required beyond authentication; (3) low complexity—the attack does not require timing, chaining, or user interaction; (4) zero impact on confidentiality or integrity. The score does not account for the fact that exploitation requires prior authentication, which the CVSS vector correctly encodes via PR:L (Privileges Required: Low). The score is appropriate for the technical risk; business risk may be higher if Kibana is mission-critical.

Frequently asked questions