PT-2026-26325 · Elastic · Kibana

Ismisepaul + 1 · Publicado 2026-03-19 · Atualizado 2026-03-23 · CVE-2026-26940

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An improper validation of the quantity specified in input within the Timelion visualization plugin can lead to a denial of service through excessive allocation. An authenticated user can send a specially crafted Timelion expression that overwrites internal series data properties with an excessively large quantity value. This issue is related to CAPEC-130 and CWE-1284.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-1284

Identificadores relacionados

CVE-2026-26940

Produtos afetados

Kibana

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-26940 · Nota de Segurança
• https://twitter.com/CVEnew/status/2036024191716392971 · Publicação no Twitter
• https://discuss.elastic.co/t/kibana-8-19-13-9-2-7-9-3-2-security-update-esa-2026-20/385535 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034734057590837338 · Publicação no Twitter