AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticCVE-2026-49091

Elastic Kibana: tampering

Elastic

CVE-2026-49091 · Published Jul 1, 2026 · updated Jul 2, 2026

High8.0
No fix yet
Elastic advisory

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 8.0.0, <= 8.11.0No fix yet
>= 7.0.0, <= 7.17.14No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-116

More Elastic advisories

All Elastic
Medium 6.5Jul 1Elasticsearch: resource exhaustionCVE-2026-49090no fix yetMedium 6.5Jul 1Elastic Fleet Server: denial of serviceCVE-2026-56150no fix yetMedium 6.5Jul 1Elastic Kibana: improper input validationCVE-2026-56151no fix yetMedium 5.3Jul 1Elastic Kibana: improper authorizationCVE-2026-56152no fix yetMedium 6.5Jul 1Elasticsearch: denial of serviceCVE-2026-56148no fix yetMedium 4.9Jul 1Elasticsearch: denial of serviceCVE-2026-56149no fix yet