CVE-2026-94400
Elastic Kibana: denial of service
- Risk score
- 46/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
- Affected
- Elastic Kibana
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Elastic Kibana: Yellow, plan it in. Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user hol…
The flaws
- CVE-2026-94400: Denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-102406: Authorisation bypass (CVSS 8.8 · EPSS 0%)
- CVE-2026-102412: Incorrect authorisation can lead to information disclosure (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Elastic Kibana
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days
- Same product: Earlier Elastic Kibana warnings. 1 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
Last activity 26 Sep 2026. Patch Forecast updates every hour.