Kibana Log Injection Vulnerability (CVE-2026-49091) Advisory and Patch

Vulnerability Overview Vulnerability Name: Improper Output Neutralization for Logs in Kibana Leading to Log Injection CVE ID: CVE-2026-49091 Issue Type: CWE-117 - Improper Output Neutralization for Logs Impact: CAPEC-93 - Log Injection-Tampering-Forging Severity: High (8.0) Affected Versions Affected Versions: - 7.x: All versions up to and including 7.17.14 - 8.x: All versions from 8.0.0 up to and including 8.11.0 Affected Configurations: - All configurations are affected Remediation Solution: - This issue has been resolved in versions 7.17.15 and 8.11.1. For Users Unable to Upgrade: - Self-Hosted: When viewing Kibana log files, use only tools that do not interpret terminal control sequences. - Cloud: The same guidance applies to Elastic Cloud managed deployments. Additional Information Detection Indicators: - Check log files for unexpected terminal control or escape sequences. Elastic Cloud Serverless: - Due to the continuous deployment and patching model, this vulnerability has been mitigated before its release in the Elastic Cloud Serverless service. Related Topics Kibana 8.11.1 Security Update (ESA-2023-25) Kibana 8.10.1 Security Update Kibana 8.18.9, 8.19.6, 9.0.8, 9.1.6 Security Update (ESA-2026-50) Kibana 8.11.2, 7.17.16 Security Update (ESA-2023-27) Kibana 8.19.16, 9.3.5 Security Update (ESA-2026-34) Summary This vulnerability involves a log injection issue in Kibana that could potentially lead to log file tampering. Affected versions include specific releases within the 7.x and 8.x branches. It is recommended to upgrade to versions 7.17.15 and 8.11.1 for a fix. For users unable to upgrade, mitigation measures are provided.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana Log Injection Vulnerability (CVE-2026-49091) Advisory and Patch