CVE-2026-0528
📋 TL;DR
This CVE describes two denial-of-service vulnerabilities in Metricbeat where specially crafted payloads sent to Graphite or Zookeeper metricsets, or malformed metric data sent to the Prometheus helper module, can cause the service to crash. Users running vulnerable versions of Metricbeat with these metricsets enabled are affected.
💻 Affected Systems
- Elastic Metricbeat
📦 What is this software?
Kibana by Elastic
Kibana by Elastic
Kibana by Elastic
Kibana by Elastic
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service where Metricbeat crashes and stops collecting metrics, potentially affecting monitoring capabilities across infrastructure.
Likely Case
Intermittent Metricbeat crashes requiring manual restart, causing gaps in metric collection and monitoring visibility.
If Mitigated
Minimal impact with proper network controls and input validation in place, potentially causing temporary service disruption.
🎯 Exploit Status
Exploitation requires sending specially crafted payloads to vulnerable endpoints, which is relatively straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.19.10, 9.1.10, or 9.2.4
Vendor Advisory: https://discuss.elastic.co/t/metricbeat-8-19-10-9-1-10-9-2-4-security-update-esa-2026-01/384519
Restart Required: Yes
Instructions:
1. Download the patched version from Elastic's official repository. 2. Stop the Metricbeat service. 3. Install the updated version. 4. Restart the Metricbeat service. 5. Verify the service is running correctly.
🔧 Temporary Workarounds
Disable vulnerable metricsets
allTemporarily disable Graphite server, Zookeeper server metricsets, and Prometheus helper module if not required.
Edit metricbeat.yml and comment out or remove the affected modules
Network isolation
linuxRestrict network access to Metricbeat endpoints using firewall rules.
iptables -A INPUT -p tcp --dport [metricbeat_port] -s [trusted_ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [metricbeat_port] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send data to Metricbeat endpoints
- Monitor Metricbeat process health and implement automatic restart mechanisms for crashes
🔍 How to Verify
Check if Vulnerable:
Check Metricbeat version with: metricbeat versionCheck Version:
metricbeat versionVerify Fix Applied:
Verify version is 8.19.10, 9.1.10, or 9.2.4 or higher with: metricbeat version📡 Detection & Monitoring
Log Indicators:
- Metricbeat crash logs
- Unexpected process termination
- Error messages related to array bounds or input validation
Network Indicators:
- Unusual traffic patterns to Metricbeat ports
- Large or malformed payloads sent to metric endpoints
SIEM Query:
process.name:"metricbeat" AND (event.action:"crashed" OR log.level:"error")