CVE-2026-49096: Uncaught Exception in Kibana Cases Leading to Denial of Service
Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49096?
The severity of CVE-2026-49096 is rated as medium with a score of 4.3.
How can I fix CVE-2026-49096?
To fix CVE-2026-49096, ensure that you update Kibana to the latest version where this issue has been addressed.
What type of attack does CVE-2026-49096 relate to?
CVE-2026-49096 relates to input data manipulation that can lead to a denial of service.
What is the impact of CVE-2026-49096?
The impact of CVE-2026-49096 can result in a denial of service due to unhandled exceptions caused by malformed link syntax.
In which software is CVE-2026-49096 found?
CVE-2026-49096 is found in Kibana, specifically in the Cases feature.