CVE-2026-26931: elastic metricbeat

CVSS: 5.7v3.1MediumAnalyzed

AliasesGHSA-5vrw-qjxw-89r5GO-2026-4790CGA-235f-28hv-q9v9+189 more

Published 19-03-2026Last modified 19-03-2026

Vulnerability summary

CVE-2026-26931 is a medium (CVSS 5.7) vulnerability in elastic metricbeat. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 21.9% of scored vulnerabilities.

Overall risk

23/100

0100

Low · default modelHow is this calculated?

CVSS score

5.7/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.31%

0%100%

Low · +0.12 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2

OPENSUSE-SU-2026:21483-1 CGA-4394-P4M2-WW78

Timeline

19-03-2026
PublishedVulnerability first disclosed.
19-03-2026
Last modifiedVulnerability information updated.

Description

Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).

CVSS metrics

4 scores · 4 sources · 1 version

v3.15.7

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

+0.12 pp

From 0.18% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected systems

Chainguard95 products

agentbeatAll versions (No fix recorded)
agentbeat-fipsAll versions (No fix recorded)
apm-server-7.17All versions (No fix recorded)
apm-server-8.17All versions (No fix recorded)
apm-server-8.18All versions (No fix recorded)

apm-server-8.19All versions (No fix recorded)
apm-server-9.0All versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-9.2All versions (No fix recorded)
apm-server-9.3All versions (No fix recorded)
apm-server-fips-7.17All versions (No fix recorded)
apm-server-fips-8.17All versions (No fix recorded)
apm-server-fips-8.18All versions (No fix recorded)
apm-server-fips-9.0All versions (No fix recorded)
apm-server-fips-9.1All versions (No fix recorded)
auditbeat-8.17All versions (No fix recorded)
auditbeat-8.18All versions (No fix recorded)
auditbeat-8.19All versions (No fix recorded)
auditbeat-9.0All versions (No fix recorded)
auditbeat-9.1All versions (No fix recorded)
auditbeat-9.3All versions (No fix recorded)
auditbeat-9.4All versions (No fix recorded)
auditbeat-fips-8.17All versions (No fix recorded)
auditbeat-fips-8.18All versions (No fix recorded)
auditbeat-fips-8.19All versions (No fix recorded)
auditbeat-fips-9.0All versions (No fix recorded)
auditbeat-fips-9.1All versions (No fix recorded)
auditbeat-fips-9.2All versions (No fix recorded)
auditbeat-fips-9.3All versions (No fix recorded)
auditbeat-fips-9.4All versions (No fix recorded)
auditbeat-fips-9.5All versions (No fix recorded)
cloudbeat-8.17All versions (No fix recorded)
cloudbeat-8.18All versions (No fix recorded)
cloudbeat-9.0All versions (No fix recorded)
cloudbeat-9.1All versions (No fix recorded)
cloudbeat-fips-8.17All versions (No fix recorded)
cloudbeat-fips-8.18All versions (No fix recorded)
cloudbeat-fips-9.0All versions (No fix recorded)
cloudbeat-fips-9.1All versions (No fix recorded)
elastic-agent-8.17All versions (No fix recorded)
elastic-agent-8.18All versions (No fix recorded)
elastic-agent-9.0All versions (No fix recorded)
elastic-agent-9.1All versions (No fix recorded)
elastic-agent-fips-8.17All versions (No fix recorded)
elastic-agent-fips-8.18All versions (No fix recorded)
elastic-agent-fips-9.0All versions (No fix recorded)
elastic-agent-fips-9.1All versions (No fix recorded)
filebeat-8.17All versions (No fix recorded)
filebeat-8.18All versions (No fix recorded)
filebeat-8.19All versions (No fix recorded)
filebeat-9.0All versions (No fix recorded)
filebeat-9.1All versions (No fix recorded)
filebeat-9.3All versions (No fix recorded)
filebeat-9.4All versions (No fix recorded)
filebeat-fips-8.17All versions (No fix recorded)
filebeat-fips-8.18All versions (No fix recorded)
filebeat-fips-8.19All versions (No fix recorded)
filebeat-fips-9.0All versions (No fix recorded)
filebeat-fips-9.1All versions (No fix recorded)
filebeat-fips-9.2All versions (No fix recorded)
filebeat-fips-9.3All versions (No fix recorded)
filebeat-fips-9.4All versions (No fix recorded)
filebeat-fips-9.5All versions (No fix recorded)
heartbeat-8.17All versions (No fix recorded)
heartbeat-8.18All versions (No fix recorded)
heartbeat-8.19All versions (No fix recorded)
heartbeat-9.0All versions (No fix recorded)
heartbeat-9.1All versions (No fix recorded)
heartbeat-9.3All versions (No fix recorded)
heartbeat-9.4All versions (No fix recorded)
heartbeat-fips-8.17All versions (No fix recorded)
heartbeat-fips-8.18All versions (No fix recorded)
heartbeat-fips-8.19All versions (No fix recorded)
heartbeat-fips-9.0All versions (No fix recorded)
heartbeat-fips-9.1All versions (No fix recorded)
heartbeat-fips-9.2All versions (No fix recorded)
heartbeat-fips-9.3All versions (No fix recorded)
heartbeat-fips-9.4All versions (No fix recorded)
heartbeat-fips-9.5All versions (No fix recorded)
metricbeat-8.17All versions (No fix recorded)
metricbeat-8.18All versions (No fix recorded)
metricbeat-8.19All versions (No fix recorded)
metricbeat-9.0All versions (No fix recorded)
metricbeat-9.1All versions (No fix recorded)
metricbeat-9.3All versions (No fix recorded)
metricbeat-9.4All versions (No fix recorded)
metricbeat-fips-8.17All versions (No fix recorded)
metricbeat-fips-8.18All versions (No fix recorded)
metricbeat-fips-8.19All versions (No fix recorded)
metricbeat-fips-9.0All versions (No fix recorded)
metricbeat-fips-9.1All versions (No fix recorded)
metricbeat-fips-9.2All versions (No fix recorded)
metricbeat-fips-9.3All versions (No fix recorded)
metricbeat-fips-9.4< 9.4.1-r4
metricbeat-fips-9.5All versions (No fix recorded)

Show all 95

Elastic1 product

metricbeat≥ 8.0.0, ≤ 8.19.12 | ≥ 8.0.0, < 8.19.13 | ≥ 9.0.0, < 9.2.5

Github.com/elastic1 product

beatsAll versions (No fix recorded)

Github.com/elastic/beats1 product

v7< 7.0.0-alpha2.0.20260112100137-de072c4e371e

4 vendors · 98 products

References

5 links

discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532WEBMitigationVendor Advisory
nvd.nist.gov/vuln/detail/CVE-2026-26931Advisory
github.com/elastic/beats/commit/de072c4e371eafeb2a42d65b9ad513f666e4ffd7WEBFIX
github.com/elastic/beatsPACKAGE
github.com/advisories/GHSA-5vrw-qjxw-89r5Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities