CVE-2026-94400

Executive Summary

CVE-2026-94400 is an uncontrolled resource consumption (CWE-400) vulnerability in Kibana that can be triggered to cause a denial-of-service condition via excessive allocation (CAPEC-130). The flaw is remotely reachable and requires only low privileges on the network (PR:L), meaning an authenticated user with limited access can degrade or exhaust server resources without user interaction. Successful exploitation affects availability only (A:H) — there is no impact to confidentiality or integrity, and no public exploit, PoC, or Nuclei template is known at the time of writing. As of this report, no vendor patch has been identified and the issue remains unpatched per tracked sources.

Technical Analysis

CVE-2026-94400 is classified under CWE-400 (Uncontrolled Resource Consumption) and mapped to CAPEC-130 (Excessive Allocation). This class of vulnerability arises when an application fails to properly bound or throttle the resources consumed by a request or operation, allowing an attacker to drive the process toward memory exhaustion, CPU saturation, thread-pool starvation, or file-descriptor depletion.

The NVD description states that the issue affects Kibana, Elastic's web-based visualization and management front end for the Elastic Stack. The CVSS v3.1 vector — AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H — indicates:

• Network reachable (AV:N): an attacker interacts with Kibana over the network, typically its HTTP interface.
• Low attack complexity (AC:L): no special conditions or race windows are required.
• Low privileges required (PR:L): the attacker must hold some level of authenticated access rather than being fully anonymous.
• No user interaction (UI:N): no victim has to click or otherwise participate.
• High availability impact (A:H): the primary and only rated impact is loss of availability.

The specific internal mechanism — which request pattern, API surface, or resource allocation path is abused — is not disclosed in the available intelligence. The NVD description provides only the vulnerability class (uncontrolled resource consumption) and the attack goal (excessive allocation leading to denial of service). It does not name an endpoint, parameter, configuration setting, function, or code path.

Accordingly, this report does not speculate on a specific Kibana route, method, or parameter. What can be stated factually is the vulnerability class: an authenticated, low-privilege user can cause Kibana to allocate resources without effective bounds. In practice, uncontrolled allocation in a web service manifests as one or more of the following mechanisms:

• Request amplification: a single small request causes disproportionate server-side allocation (large buffers, deep object graphs, recursive parsing).
• Missing rate limiting or quota enforcement: an endpoint that should cap concurrent operations does not, letting a caller drive allocation repeatedly.
• Unbounded growth of in-memory structures: responses or internal caches grow proportional to attacker-controlled input with no ceiling.

Any of these would be consistent with CWE-400/CAPEC-130. Because the exact trigger is undisclosed, defenders should treat the entire Kibana HTTP surface reachable by low-privilege users as the potential attack surface and prioritize resource-exhaustion monitoring (see Detection Guidance).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-94400. The attack chain below is inferred strictly from the vulnerability class described in the NVD data (uncontrolled resource consumption, excessive allocation, DoS). No endpoint names, parameters, or function names are asserted because none are provided in the source intelligence.

1. Reconnaissance / target identification. An attacker locates a reachable Kibana instance. Kibana typically listens on TCP 5601; the Shodan dorks above can identify internet-facing deployments. The attacker confirms the version where possible and establishes whether low-privilege authenticated access is obtainable (self-registration, valid credentials, or a compromised low-privilege account).

2. Triggering the flaw class. Because the CVSS vector requires low privileges (PR:L), the attacker authenticates with a low-privilege account and issues requests that cause Kibana to allocate resources in an uncontrolled manner. At the vulnerability-class level, this is a request that the server processes without enforcing an adequate resource ceiling — the exact request shape is undisclosed. The attacker can repeat or parallelize such requests, since AC:L indicates no difficult preconditions.

3. Payload / execution method. No memory-corruption, injection, or code-execution payload is involved. The "payload" is simply the abusive request pattern itself (repetition, concurrency, or oversized input) that drives resource consumption. The attacker does not need to deliver a malicious file or exploit primitive — the vulnerable behavior is reached through normal authenticated interaction with the application.

4. Post-exploitation impact. Sustained resource consumption degrades Kibana availability (A:H). Effects can include slow or unresponsive dashboards, failed API calls, elevated latency for legitimate users, and in severe cases process or container termination (OOM-kill) that takes Kibana offline. The blast radius is bounded to availability; there is no rated confidentiality or integrity impact, and no lateral movement or data exfiltration is implied by the CVSS vector.

Caveat: The absence of a public exploit means real-world exploitability, required request volume, and time-to-impact cannot be stated with confidence. Defenders should not assume the flaw is low-risk solely because no PoC is public; unpatched DoS issues in internet-facing services are frequently weaponized by availability-focused actors and by opportunists.

Impact Assessment

• Availability (A:H): The dominant impact. A successful attack can render Kibana unresponsive or take it offline, disrupting dashboards, saved-object management, alerting configuration, and any operational workflows that depend on Kibana as the front end for the Elastic Stack.
• Confidentiality (C:N) / Integrity (I:N): No rated impact. This is consistent with a pure resource-consumption flaw.
• Scope (S:U): Impact is confined to Kibana's own security authority. Note, however, that an availability failure in Kibana can indirectly affect dependent operational processes (e.g., SOC analysts unable to view dashboards, alert triage delays) even though the CVSS scope is unchanged.
• Attack prerequisites: Network reachability (AV:N), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N). The low-privilege requirement meaningfully narrows the attacker pool to those with any authenticated Kibana access — including a compromised low-privilege account, an insider, or a self-service registration where enabled.
• Blast radius: Kibana itself and its direct consumers. Elasticsearch clusters are not implied to be affected by this vector, though operational disruption to Kibana can impair monitoring and response capabilities if Kibana is part of a detection/observability stack.

Detection Guidance

Detection must rely on behavioral and volumetric signals because the precise trigger is undisclosed. The rules below are generic resource-exhaustion detections for Kibana — they are not derived from a known exploit signature and should be tuned to baseline.

Sigma Rule

title: Potential Kibana Resource Exhaustion Activity (CVE-2026-94400)
id: 8f1c2b44-9a7d-4e21-b6c3-2f0a5d9e7c10
status: experimental
description: Detects repeated or bursty Kibana HTTP requests consistent with uncontrolled resource consumption / denial of service. Trigger specifics for CVE-2026-94400 are undisclosed; this rule is behavioral.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94400
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_process:
    cs-uri-stem|contains:
      - '/api/'
  selection_status:
    sc-status:
      - 200
      - 429
      - 500
      - 503
  timeframe: 1m
  condition: selection_process and selection_status | count() by c-ip > 300
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate bulk automation, dashboard refresh storms, load testing
level: medium
tags:
  - attack.t1499
  - cwe.400

YARA Rule

rule CVE_2026_94400_Kibana_Resource_Exhaustion_Indicators
{
    meta:
        description = "Generic indicators of high-volume Kibana API request bursts. No public PoC exists for CVE-2026-94400; this rule targets behavioral/log artifacts, not a known payload."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94400"
        date = "2026-01-01"
        cwe = "CWE-400"

    strings:
        $kbn1 = "kibana" nocase
        $api1 = "/api/" ascii
        $err1 = "ECONNRESET" ascii
        $err2 = "heap out of memory" nocase
        $err3 = "JavaScript heap out of memory" nocase
        $exc1 = "allocation failed" nocase
        $exc2 = "out of memory" nocase

    condition:
        ($kbn1 and $api1) or any of ($err*) or any of ($exc*)
}

Suricata IDS Rule

alert http any any -> any 5601 (msg:"CVE-2026-94400 Potential Kibana Resource Exhaustion - High Volume API Requests"; flow:established,to_server; http.uri; content:"/api/"; http.method; content:"GET"; threshold:type both, track by_src, count 300, seconds 60; classtype:attempted-dos; sid:9440001; rev:1; reference:cve,2026-94400; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: The threshold-based approach requires Suricata threshold support; per-request volumetric rules are inherently heuristic given the undisclosed trigger.

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where destination.port == 5601 and url.path : "/api/*" ]
  [ network where destination.port == 5601 and url.path : "/api/*" ]
  [ network where destination.port == 5601 and url.path : "/api/*" ]

Because EQL cardinality limits exist, pair this with an EQL any-style count alternative or an aggregation rule in Elastic Security (threshold rule) counting url.path from the same source.ip against Kibana, alerting above a tuned per-minute baseline.

Splunk SPL Query

index=web OR index=kibana sourcetype=access_combined OR sourcetype=kibana
| where match(uri_path, "^/api/")
| bin _time span=1m
| stats count AS reqs, dc(uri_path) AS distinct_paths, avg(bytes) AS avg_bytes BY _time, clientip, uri_path
| where reqs > 300
| table _time, clientip, uri_path, reqs, distinct_paths, avg_bytes

Tune the reqs > 300 threshold against your environment's normal Kibana API request rate.

Wazuh OSSEC Rule

<group name="kibana,web,attack,">
  <rule id="944000" level="10" frequency="300" timeframe="60">
    <if_matched_sid>944001</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-94400: Possible Kibana resource-exhaustion (DoS) - high-frequency /api/ requests from single source</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,pci_dss_10.2.4,gdpr_IV_35.7.d,</group>
  </rule>

  <rule id="944001" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/</url>
    <description>Kibana API request (baseline)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source; the vendor fix field is N/A and no vendor advisory or fixed version is available. The following guidance is therefore constrained to interim controls and general hardening.

1. Immediate mitigations

   • Restrict network exposure. Do not expose Kibana (default TCP 5601) to untrusted networks. Place it behind a reverse proxy, VPN, or zero-trust access layer.
   • Enforce authentication and least privilege. Since PR:L applies, strictly limit which accounts can reach Kibana and audit low-privilege accounts for anomalous use. Disable self-registration if enabled.
   • Apply rate limiting / quotas at the reverse proxy or API gateway in front of Kibana, capping per-client request rates and concurrent connections to blunt volumetric resource abuse.
   • Resource-isolate Kibana. Set container/process memory and CPU limits so a resource-exhaustion event degrades Kibana without impacting co-located services, and configure restart policies with monitoring.
   • Monitor availability. Alert on Kibana latency, error rate (429/500/503), heap pressure, and OOM-kill events.

2. Patch / upgrade steps

   • No patch is currently identified for CVE-2026-94400. Monitor the Elastic Security Advisories page and the NVD entry (links below) for a fixed Kibana version. When a fix is released, test in staging and upgrade promptly. Until then, treat the system as unpatched and rely on mitigations above.

3. Long-term hardening

   • Maintain an inventory of Kibana instances and their versions; track them against Elastic advisories.
   • Adopt defense-in-depth for availability: WAF/reverse-proxy rate limiting, resource caps, health-based auto-restart, and redundant Kibana nodes behind a load balancer.
   • Baseline normal API request volumes per client and tune the detection rules above to your environment so anomalies stand out.
   • Incorporate resource-exhaustion scenarios into resilience/chaos testing to validate limits and failover behavior.

References

• NVD — CVE-2026-94400: https://nvd.nist.gov/vuln/detail/CVE-2026-94400
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• CAPEC-130 — Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Elastic Security Advisories (monitor for a fixed Kibana release): https://www.elastic.co/community/security

Threat actor / exploit-in-the-wild evidence: None available. CVE-2026-94400 is not listed in CISA KEV, no public PoC, exploit code, or Nuclei template exists, and no associated campaigns are identified in the provided intelligence. EPSS has not yet been scored by FIRST.org, so no exploitation-probability estimate can be cited.