CVE-2026-0543

{"id": "CVE-2026-0543", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0543", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T21:22:53.219447Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.9"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.17.29"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.1.9"}, {"status": "affected", "version": "9.2.0", "versionType": "semver", "lessThanOrEqual": "9.2.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-13T21:15:51.170", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-10-9-1-10-9-2-4-security-update-esa-2026-08/384523", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed."}, {"lang": "es", "value": "La Validaci\u00f3n de Entrada Incorrecta (CWE-20) en el Conector de Correo Electr\u00f3nico de Kibana puede permitir a un atacante causar una Asignaci\u00f3n Excesiva (CAPEC-130) a trav\u00e9s de un par\u00e1metro de direcci\u00f3n de correo electr\u00f3nico especialmente dise\u00f1ado. Esto requiere que un atacante tenga acceso autenticado con privilegios de nivel de vista suficientes para ejecutar acciones del conector. La aplicaci\u00f3n intenta procesar un formato de correo electr\u00f3nico especialmente dise\u00f1ado, lo que resulta en una indisponibilidad completa del servicio para todos los usuarios hasta que se realice un reinicio manual."}], "lastModified": "2026-06-17T10:10:55.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8820B4BC-0DAB-4C9B-8053-90DE2C19646E", "versionEndIncluding": "7.17.29", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D2BD2D1-17FA-4143-9F5F-ACDA3DA08954", "versionEndExcluding": "8.19.0", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC3281ED-A331-43DC-9705-80A3FA3E6C75", "versionEndExcluding": "9.1.10", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BF9D6AE-B07F-4516-A684-60B02BF731A0", "versionEndExcluding": "9.2.4", "versionStartIncluding": "9.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}