CVE-2026-49088

MEDIUM

Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure

Title source: cna

Description

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.

References (1)

Core 1

Core References

https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50

Scores

CVSS v3 4.4

EPSS 0.0021

EPSS Percentile 11.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (5)

Elastic/Kibana 8.0.0 - 8.18.8

elastic/kibana 8.0.0 - 8.18.9

Elastic/Kibana 8.19.0 - 8.19.5

Elastic/Kibana 9.0.0 - 9.0.7

Elastic/Kibana 9.1.0 - 9.1.5

Published Jul 01, 2026

Tracked Since Jul 01, 2026