CVE-2021-22139: Elastic Kibana

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit on the request size. An attacker with permissions to create webhook actions could drain the Kibana host connection pool, making Kibana unavailable for all other users.

Affected products

• Elastic Kibana: before 7.12.1 (fixed in 7.12.1)

Published 2021-05-13. Last modified 2026-06-17.