CVE-2026-0528: 
Kibana vulnerability analysis and mitigation

CVE-2026-0528 is a Denial of Service vulnerability in Elastic Metricbeat affecting the Graphite server metricset, Zookeeper server metricset, and Prometheus helper module. It was disclosed on January 13, 2026, by Elastic (ESA-2026-01) and affects Metricbeat versions 7.0.0–7.17.28, 8.0.0–8.19.9, 9.0.0–9.1.9, and 9.2.0–9.2.3. The vulnerability has a CVSS v3.1 base score of 7.5 (High) per NVD, and 6.5 (Medium) per Elastic's own CNA assessment (Elastic Advisory, Red Hat CVE).

The vulnerability encompasses two distinct weaknesses: Improper Validation of Array Index (CWE-129) in the Graphite and Zookeeper metricsets, and Improper Input Validation (CWE-20) in the Prometheus helper module. An attacker can exploit these flaws by sending specially crafted, malformed payloads to the affected metricsets or malformed metric data to the Prometheus module, triggering an out-of-bounds array access or unhandled input condition that crashes the Metricbeat process. No authentication or user interaction is required; the attack vector is network-adjacent per Elastic's scoring (AV:A), though NVD assessed it as fully network-accessible (AV:N) (Elastic Advisory, Red Hat CVE).

Successful exploitation results in a crash of the Metricbeat monitoring agent, causing a complete loss of availability (A:H) for the affected instance with no impact on confidentiality or integrity. This disrupts infrastructure monitoring capabilities, potentially blinding operators to system health issues, performance anomalies, or concurrent attacks on monitored systems. The impact is limited to the Metricbeat process itself and does not enable lateral movement or data exfiltration (Elastic Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Elastic Advisory). The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Elastic has released patched versions of Metricbeat addressing this vulnerability: 7.17.29 (for 7.x branch), 8.19.10 (for 8.x branch), 9.1.10 (for 9.1.x branch), and 9.2.4 (for 9.2.x branch). Organizations unable to patch immediately should restrict network access to Metricbeat instances, specifically limiting connections to the Graphite and Zookeeper metricsets to trusted sources only. Upgrading to a patched version is the recommended long-term remediation (Elastic Advisory).

Security Online Info covered the vulnerability as part of a broader report on seven new Elastic Stack flaws, noting that the issues expose monitoring infrastructure to crashes (Security Online). The NetEye blog published a security advisory for Elastic Stack users in their environment (NetEye Blog). Red Hat also tracked the CVE for potential impact on their product offerings (Red Hat CVE). Overall community reaction has been measured, consistent with the moderate severity and lack of active exploitation.