CVE-2026-0543

Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation

State: Published
Severity: 6.5 Medium
Published: Jan 13, 2026
Updated: Jan 13, 2026
Reserved: Dec 31, 2025

Description

Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	elastic

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
KibanaElastic	8.0.0 through 8.19.9Affected 7.0.0 through 7.17.29Affected 9.0.0 through 9.1.9Affected 9.2.0 through 9.2.3Affected

References

https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-08/384523

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.