PT-2026-44493 · Elastic · Kibana

Ismisepaul + 1 · CVE-2026-42401 · Published 2026-05-28 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Improper neutralization of input during web page generation allows for stored HTML injection. A user with write access to an Elasticsearch index can persist crafted markup that is not sufficiently sanitized when rendered through a Kibana view by another user. This can lead to unauthorized UI manipulation and outbound network requests issued from the browser session of the user viewing the content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-ELK-2026-42401

BIT-KIBANA-2026-42401

CVE-2026-42401

Affected Products

Kibana

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42401.json · Exploit
• https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42401 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42401 · Security Note
• https://osv.dev/vulnerability/BIT-elk-2026-42401 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2026-42401 · Vendor Advisory