CVE-2026-49091 | Improper Output Neutralization for Logs (CWE-117) in Kibana … | CVSS 8.0 HIGH

Description

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Metadata

CVE ID: CVE-2026-49091
State: PUBLISHED
Assigner: elastic
Reserved: 2026-05-27 11:31 UTC
Published: 2026-07-01 17:21 UTC
Last updated: 2026-07-02 03:57 UTC
Primary CWE: CWE-116
CWE-116 Improper Encoding or Escaping of Output
Vendor / Product: Elastic / Kibana
Sources: cve.org · NVD

Severity & Metrics

8.0 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Elastic	Kibana	—	8.0.0 ≤ 8.11.0, 7.0.0 ≤ 7.17.14

Weakness (CWE)

CWE	Source	Description
CWE-116	cna	CWE-116 Improper Encoding or Escaping of Output

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.0	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References (1)

https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53