CVE-2026-49088: Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable optional application performance monitoring (APM) instrumentation in Kibana to prevent sensitive request header values from being recorded in application logs.
Kibana (APM instrumentation) APM instrumentation = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49088?
The severity of CVE-2026-49088 is medium with a CVSS score of 4.4.
How do I fix CVE-2026-49088?
To fix CVE-2026-49088, disable the application performance monitoring (APM) instrumentation in Kibana.
What type of information is exposed in CVE-2026-49088?
CVE-2026-49088 can lead to the exposure of sensitive request header values in application logs.
Which software is affected by CVE-2026-49088?
CVE-2026-49088 affects Elastic Kibana.
When was CVE-2026-49088 published?
CVE-2026-49088 was published on July 1, 2026.