VYPR
← All advisories
High severity8.0NVD Advisory· Published Jul 1, 2026· Updated Jul 2, 2026

CVE-2026-49091

CVE-2026-49091

Description

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Affected products

2
  • Elastic/Kibana2 versions
    cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*range: >=7.0.0,<7.17.15
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.