Dashboard / CVE-2026-49091

CVE-2026-49091

HIGH
MEDIUM Priority: 0.03 BB Relevance: 46/100
Published: 2026-07-01 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: Required
S: Changed
C: High
I: High
A: High

Description

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
elastic kibana 7.0.0 – 7.17.15

References & Advisories (1)

Bug Bounty Relevance

46 / 100
✓ Network accessible

CVSS Score

8.0 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.32%
Raw Score 0.003170
Percentile 24.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00317
2026-10-28
0.00317

Intelligence Sources

nvd ref →

External Links