Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-08)

A security vulnerability (CVE-2026-0543) in Kibana's Email Connector allows authenticated attackers with view-level privileges to cause service unavailability through improper input validation. The vulnerability affects all Kibana 7.x versions, 8.x versions up to 8.19.9, and specific 9.x versions up to 9.1.9 and 9.2.3. Attackers can exploit specially crafted email address parameters to cause excessive allocation, resulting in complete service unavailability requiring manual restart. The issue has been patched in versions 8.19.10, 9.1.10, and 9.2.4. CVSS score is 6.5 (Medium severity) with high availability impact.