CVE-2026-72674

This CVE in Kibana's RAG Playground feature exposes a gap that's becoming common as teams bolt AI capabilities onto established platforms. The vulnerability: users can supply an arbitrarily large list of field names that the server uses to construct responses, combined with no deduplication. A single request can amplify into disproportionate server-side processing. What makes this worth your attention isn't the technical complexity — the fix is five lines, a length check and a Set() call. The concern is what this reveals about how AI features are being integrated. The developer who wrote this likely understood input validation for traditional endpoints — sanitize strings, enforce schema. But the RAG feature inverted the consumption model: instead of the server limiting what it returns, the user supplies a field list that drives response construction. The cognitive frame was 'return the right data' not 'enforce limits on what a single request can trigger.' The downstream risk compounds because Kibana often sits at the center of your observability stack — the tool analysts reach for when something breaks. Resource exhaustion here doesn't just mean unavailable dashboards; it can blind your incident response capability during the very crisis where you need visibility. Check your own AI feature integrations: are parameters that control response construction or data aggregation bounded and deduplicated? Does your security review specifically address resource consumption amplification, or does it focus on injection vectors? The pattern here — unbounded user-controlled lists driving server-side response assembly — has appeared in LDAP attribute enumeration, GraphQL field selection, and now RAG features. It's being rediscovered each time because organizations aren't codifying the fix into durable architectural constraints. A shared library, a SAST rule, a security champion checklist — something that outlasts the engineer who originally discovered the problem. CVSS scores this 6.5, which will invite patching delays. Treat resource consumption vulnerabilities in observability infrastructure with higher urgency than the CVSS suggests — the blast radius extends beyond the tool itself.

Reviewed through automated stages and approved by a human before publication.