EIQ-2026-0010#

ID

EIQ-2026-0010

CVE

CVE-2026-63261

Description

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service via Machine Learning Feature

Date

30 July 2026

Severity

1 - LOW

CVSSv3 score

2.7

Status

⏲

Assessment

Uncontrolled Resource Consumption in Kibana’s machine learning feature. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

EclecticIQ Intelligence Center does not expose Kibana’s machine learning features to end users. To trigger this exploit, the attacker would need direct access to the Kibana interface, which is not exposed by default in Intelligence Center deployments.

Kibana is not used by EclecticIQ Intelligence Center features; it is provided as a debugging tool.

Elastic CVSS3.1: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EIQ CVSS3.1: 2.7 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Links:

Mitigation

Upgrade to IC 3.8.0 when available, which ships with Kibana 9.4.4.

EclecticIQ Intelligence Center does not expose Kibana’s machine learning features to end users. If your deployment does not grant users direct access to Kibana, no action is required.

Administrators should restrict direct access to the Kibana REST API to only trusted hosts and services. Do not expose Kibana (port 5601) to end users or untrusted networks.

If you cannot upgrade and users have direct Kibana access, set xpack.ml.enabled: false in /etc/eclecticiq-elasticsearch/elasticsearch.yml on all Elasticsearch nodes to disable the machine learning feature and prevent exploitation. Note that this removes all machine learning functionality from the Elastic stack.

To limit the impact of resource consumption attacks on Kibana, create a systemd memory limit drop-in at /etc/systemd/system/kibana.service.d/30-eclecticiq_memory_limit.conf on the Kibana node (usually the application node):

[Service]
MemoryHigh=2000M
MemoryMax=3000M

Then run systemctl daemon-reload && systemctl restart kibana. This prevents the Kibana process from consuming all available memory on the host.

Affected versions

EIQ Intelligence Center 3.7.2 and older, or any instance using Kibana versions 8.x up to 8.19.18 (inclusive), 9.x up to 9.3.7 (inclusive), 9.4.x up to 9.4.3 (inclusive).

Notes

N/A