CVE-2026-49091

{
  "id": "CVE-2026-49091",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-01T18:16:34.040",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data."
    },
    {
      "lang": "es",
      "value": "La neutralización inadecuada de la salida para logs (CWE-117) en Kibana puede conducir a la inyección de logs a través de Inyección-Manipulación-Falsificación de Logs (CAPEC-93). Un atacante puede suministrar una entrada especialmente diseñada que se escribe en archivos de logs sin la neutralización adecuada. Cuando los archivos de logs se visualizan posteriormente en una terminal que interpreta secuencias de control, el contenido inyectado puede alterar los datos de logs mostrados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Kibana",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.11.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "7.0.0",
              "lessThanOrEqual": "7.17.14",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T00:00:00+00:00",
          "id": "CVE-2026-49091",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.0.0",
              "versionEndExcluding": "7.17.15",
              "matchCriteriaId": "A25080F6-A136-4D8F-BA71-B48402A1BC7E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.11.1",
              "matchCriteriaId": "EDC4443D-DC1A-41CB-A1BC-817A15246F81"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Mitigation"
      ]
    }
  ]
}