What’s Vulnerable › Vulnerabilities
CVE-2026-0543: Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-13 · updated 2026-06-17
- Weakness: CWE-20
Description
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
Affected products
- Kibana: from 7.0.0 through 7.17.29; from 8.0.0 before 8.19.0; from 9.0.0 before 9.1.10; from 9.2.0 before 9.2.4 — fixed in 8.19.0, 9.1.10, 9.2.4
How to fix
Upgrade to a fixed version: Kibana 8.19.0, 9.1.10, 9.2.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-0543 or the next vulnerability affects your stack