Description

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

INFO

Published Date :

2026-01-13T21:02:18.501Z

Last Modified :

2026-01-13T21:25:10.446Z

Source :

elastic
AFFECTED PRODUCTS

The following products are affected by CVE-2026-0528 vulnerability.

Vendors Products
Elastic
  • Kibana
  • Metricbeat
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-0528.

URL Resource
https://discuss.elastic.co/t/metricbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-01/384519 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact