CVE-2026-49091

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

• CWE-116

• https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53Vendor Advisory, Mitigation

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49085Unauthenticated PHP Object Injection in WP Insightly for Con…9.8
• CVE-2026-49086Improper Input Validation, Unintended Proxy or Intermediary …6.5
• CVE-2026-49087Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-49088Insertion of Sensitive Information into Log File (CWE-532) i…4.4
• CVE-2026-4909A weakness has been identified in code-projects Exam Form Su…2.4
• CVE-2026-49090Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-49092Unintended Proxy or Intermediary ('Confused Deputy') (CWE-44…4.3
• CVE-2026-49093Server-Side Request Forgery (CWE-918) in Kibana can allow an…7.7
• CVE-2026-49094Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-49095Improper Input Validation (CWE-20) in the Kibana Fleet agent…6.5
• CVE-2026-49097Improper Input Validation, Improper Neutralization of Specia…6.5
• CVE-2026-49098Improper Input Validation, Improper Neutralization of Specia…5.3