CVEvulnerability

CVE-2026-49091

8.0 HIGH Published 2026-07-01 Modified 2026-10-25 Official page ↗
Status
Analyzed
Published
2026-07-01
Last modified
2026-10-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-116

Description

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Affected configurations

• elastic kibana (>= 7.0.0 < 7.17.15) • elastic kibana (>= 8.0.0 < 8.11.1)

Related

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References