CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service

What is CVE-2026-0528?

CVE-2026-0528 is a medium-severity denial of service vulnerability in Elastic Kibana, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

Weakness: CWE-129

Which versions are affected by CVE-2026-0528?

10 open source packages ship an affected version, including github.com/elastic/beats/v7 and github.com/elastic/beats. It affects 1 product.

Products include Elastic Kibana.

How do I fix CVE-2026-0528?

Upgrade github.com/elastic/beats/v7 to a fixed version for your release line: 7.0.0-alpha2.0.20251217054608-6e42552a23ce, 8.19.10, 9.1.10 or 9.2.4.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-0528 being exploited?

There is no known exploitation of CVE-2026-0528 in the wild and no public exploit code.

Other vulnerabilities in Elastic Kibana

• CVE-2019-7609 Kibana Arbitrary Code Execution Exploited Critical 9.8
• CVE-2025-25015 Kibana arbitrary code execution via prototype pollution Critical 9.9
• CVE-2024-37288 Deserialization in Kibana Critical 9.9
• CVE-2023-31415 Code injection in Kibana Critical 9.9
• CVE-2018-17245 Information disclosure in Kibana Critical 9.8

All Elastic Kibana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w2gr-585j-r428, GO-2026-4360, MINI-3fhh-fv2x-8hqc, MINI-3hj8-2mr2-v9c8, MINI-3hw6-5m2v-vj79, MINI-4vg4-gj77-x8mj and 12 more.