CVE-2026-49091: Improper Output Neutralization for Logs in Kibana Leading to Log Injection

Published Jul 1, 2026
·
Updated

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Affected Software

3 affected components
Elastic Kibana
Elastic Kibana>=7.0.0<7.17.15
Elastic Kibana>=8.0.0<8.11.1

Event History

Jul 1, 2026
CVE Published
via MITRE·05:21 PM
Data Sourced
via MITRE·05:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-49091?

The severity of CVE-2026-49091 is classified as high with a score of 8.

2

How do I fix CVE-2026-49091?

To fix CVE-2026-49091, update to the latest version of Kibana where the vulnerability has been addressed.

3

What impact does CVE-2026-49091 have on system security?

CVE-2026-49091 can lead to log injection which compromises the integrity of logging systems and could allow attackers to tamper with log files.

4

Who is affected by CVE-2026-49091?

Users of Elastic Kibana are affected by CVE-2026-49091 if they are using a vulnerable version of the software.

5

What types of attacks can exploit CVE-2026-49091?

CVE-2026-49091 can be exploited through log injection attacks, allowing an attacker to manipulate logs that are viewed in a terminal.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203