EIQ-2026-0006#

ID

EIQ-2026-0006

CVE

CVE-2026-63139

Description

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service via Canvas

Date

30 July 2026

Severity

1 - LOW

CVSSv3 score

2.7

Status

⏲

Assessment

Uncontrolled Resource Consumption in Kibana’s Canvas functionality. An authenticated low-privileged user can send a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.

EclecticIQ Intelligence Center does not expose Kibana’s Canvas functionality to end users. To trigger this exploit, the attacker would need direct access to the Kibana interface, which is not exposed by default in Intelligence Center deployments.

Kibana is not used by EclecticIQ Intelligence Center features; it is provided as a debugging tool.

Elastic CVSS3.1: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EIQ CVSS3.1: 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Links:

Mitigation

Upgrade to IC 3.8.0 when available, which ships with Kibana 9.4.4.

EclecticIQ Intelligence Center does not expose Kibana’s Canvas functionality to end users. If your deployment does not grant users direct access to Kibana, no action is required.

Administrators should restrict direct access to the Kibana REST API to only trusted hosts and services. Do not expose Kibana (port 5601) to end users or untrusted networks.

To limit the impact of resource consumption attacks on Kibana, create a systemd memory limit drop-in at /etc/systemd/system/kibana.service.d/30-eclecticiq_memory_limit.conf on the Kibana node (usually the application node):

[Service]
MemoryHigh=2000M
MemoryMax=3000M

Then run systemctl daemon-reload && systemctl restart kibana. This prevents the Kibana process from consuming all available memory on the host.

Affected versions

EIQ Intelligence Center 3.7.2 and older, or any instance using Kibana versions 8.x up to 8.19.18 (inclusive), 9.x from 9.3.0 up to 9.3.7 (inclusive), 9.4.x up to 9.4.3 (inclusive).

Notes

N/A