Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-49091

Improper Output Neutralization for Logs in Kibana Leading to Log Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

Default version status: unaffected

  • 8.0.0 to ≤ 8.11.0affected
  • 7.0.0 to ≤ 7.17.14affected

References