Vulnerability Report

CVE-2026-0531

Title: DoS in Kibana Fleet

DoS

Proof Of Concept

No public PoC currently indexed for CVE-2026-0531.

CWE Category CWE-770

Published Date Jan 13, 2026

Modified Date Jan 22, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.1

Exploit Probability (EPSS)

0.42%

Vulnerability Summary

CVE-2026-0531: Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially crafted bulk retrieval request. This requires an attacker to have low-level privileges equivalent to the viewer role, which grants read access to agent policies. The crafted request can cause the application to perform redundant database retrieval operations that immediately consume memory until the server crashes and becomes unavailable to all users.

Impacted Vendors

elasticsearch 1

elastic 1

Reference Links

https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-04/384522

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-0531 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

January 22, 2026 MODIFIED

Vulnerability data updated via NVD.

January 22, 2026 MODIFIED

Vulnerability data updated via NVD.

January 14, 2026 MODIFIED

Vulnerability data updated via NVD.

January 13, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Stack

No specific products linked.