PT-2026-54770 · Elastic · Kibana

Kruskall · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-49091

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Improper output neutralization for logs allows for log injection. An attacker can provide specially crafted input that is written to log files without being properly neutralized. If these log files are viewed in a terminal that interprets control sequences, the injected content can alter the displayed log data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-49091

Affected Products

Kibana

References · 7

• https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49091 · Security Note
• https://t.me/cveNotify/185394 · Telegram Post
• https://t.me/cveNotify/184125 · Telegram Post
• https://twitter.com/CVEnew/status/2072388046570320375 · Twitter Post
• https://t.me/CVEtracker/58594 · Telegram Post
• https://twitter.com/infoflowcloud/status/2072389959550374170 · Twitter Post