CVE-2026-33459

CVE-2026-33459 is an uncontrolled resource consumption vulnerability in Kibana's automatic import feature that allows authenticated users to trigger denial of service attacks by submitting specially crafted requests with excessively large input values, particularly when multiple requests are sent concurrently to destabilize backend services. The vulnerability carries a CVSS score of 6.5 (Medium) with a network-based attack vector that requires low complexity and valid user credentials, but causes high availability impact resulting in service disruption across all users. The attack has not been observed in active exploitation according to KEV records, with an extremely low EPSS score of 0.000460 indicating minimal real-world exploitation probability compared to other vulnerabilities. No public exploit code is widely available, and community attention remains limited as evidenced by the inactive Hot List status. Organizations running Kibana should prioritize patching this vulnerability to prevent authenticated attackers from leveraging the automatic import feature to disrupt service availability.