CVE-2026-72651

This vulnerability in Kibana's alerting subsystem represents a fundamental failure in resource boundary enforcement rather than a sophisticated attack. A user with read-only privileges can submit a malformed payload that bypasses the alerting handler's normal processing and reaches resource allocation logic directly. One such request can exhaust resources to the point that Kibana must be restarted to restore service for all users. This isn't a theoretical concern — it's a demonstrated denial-of-service vector from the lowest privilege tier. The core issue is that input validation was either absent at this boundary or applied at the wrong layer, allowing disproportionate resource requests to pass through unmediated. There are no per-request resource ceilings, no per-user quotas, and likely no circuit breakers in this code path — baseline defenses that should exist whenever user-controlled input influences resource allocation. The CVSS score of 6.5 is misleading. It measures exploit complexity and confidentiality impact but doesn't capture the cascade effect: one low-privilege user can collapse service for every user in the deployment. This is a critical infrastructure failure dressed in medium-severity clothing. The pattern is not unique to Kibana. The same read-side CWE-770 (Allocation of Resources Without Limits) has appeared in Jenkins plugins, Atlassian Confluence, and Grafana alerting paths. The industry keeps repeating this mistake because security reviews consistently weight data modification risk over resource governance for read operations. Check whether alerting endpoints are exposed to read-only users in your Kibana deployment. Verify your version against the patch and apply immediately. In the interim, consider rate limiting on the alerting read-path or network segmentation to reduce exposure. This CVE should also prompt an audit of similar read-only endpoints across your infrastructure for the same resource governance gaps.

Reviewed through automated stages and approved by a human before publication.