CVE-2026-63261 Details

A denial-of-service vulnerability has been identified in Elastic Kibana versions 8.0.0 prior to 8.19.18, as well as in 9.0.0 prior to 9.3.7 and 9.4.0 prior to 9.4.3. This vulnerability allows a low-privileged authenticated user to send a specially crafted request to a Kibana machine learning feature. The exploitation of this vulnerability causes the server to exhaust available memory, leading to a loss of service for all users. The issue arises from uncontrolled resource consumption, specifically excessive allocation, which can be exploited when the machine learning feature is enabled and accessible to low-privileged users.

Users can upgrade to Kibana versions 8.19.19, 9.3.8, or 9.4.4 to address this vulnerability. For those who cannot upgrade, the machine learning feature can be disabled by setting 'xpack.ml.enabled' to false in the 'kibana.yml' configuration file. This change is also available through the Elasticsearch Service console's custom Kibana configuration, although it will remove all machine learning functionality from Kibana.