Kibana Improper Input Validation Leading to DoS (CVE-2026-56151)

Vulnerability Overview Vulnerability Name: Improper Input Validation in Kibana Leading to Denial of Service CVE ID: CVE-2026-56151 Issue Type: CWE-20 - Improper Input Validation Impact: CAPEC-153 - Input Data Manipulation Severity: CVSSv3.1: Medium (6.5) CVSS Score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Versions Affected Versions: - 8.x: All versions from 8.0.0 to 8.19.16 - 9.x: All versions from 9.0.0 to 9.3.5 - 9.4.x: All versions from 9.4.0 to 9.4.2 Affected Configurations: - Affects deployments using Fleet. Exploitation requires an authenticated account with permissions to manage Fleet policies. Remediation Solution: This issue has been resolved in versions 8.19.17, 9.3.6, and 9.4.3. Workaround for Users Unable to Upgrade: There are currently no known workarounds for this vulnerability. Additional Information Elastic Cloud Serverless: Due to the continuous deployment and patching model, this vulnerability was resolved prior to the release of the Elastic Cloud Serverless service. Metrics: 361 views Related Topics: - Kibana Fleet 8.19.16, 9.3.5, and 9.4.2 Security Update (ESA-2026-38) - Kibana 8.19.12, 9.2.6, 9.3.1 Security Update (ESA-2026-12) - Kibana 8.19.12, 9.2.6, 9.3.1 Security Update (ESA-2026-13) - Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-08) - Kibana 8.19.16, 9.3.5 Security Update (ESA-2026-34) POC Code or Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana Improper Input Validation Leading to DoS (CVE-2026-56151)