PT-2026-2634 · Elastic+1 · Kibana+1

Vultza · CVE-2026-0531 · Published 2026-01-13 · Updated 2026-02-24

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kibana Fleet (affected versions not specified)

Description An issue in Kibana Fleet allows for excessive resource allocation through a specially crafted bulk retrieval request. An attacker with low-level privileges, such as the viewer role providing read access to agent policies, can trigger redundant database retrieval operations. This process consumes memory rapidly, leading to a server crash and resulting in a denial of service for all users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-ELK-2026-0531

BIT-KIBANA-2026-0531

CVE-2026-0531

Affected Products

Kibana

Red Os

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0531.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-0531 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2026-0531 · Vendor Advisory
• https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-04/384522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0531 · Security Note
• https://osv.dev/vulnerability/BIT-elk-2026-0531 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-kibana-cve-2026-0531-8.0 · Note