CVE-2026-72674

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Kibana is subject to a denial of service issue due to the allocation of resources without limits or throttling. In the Kibana Playground for the RAG (Retrieval-Augmented Generation) feature, a user-supplied list of document fields is neither bounded in length nor de-duplicated before being used to assemble responses for matching documents. A crafted request can force the system to build a response significantly larger than the source data, leading to excessive memory pressure and resource exhaustion of the instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.