CVE-2026-49091

8.0 Élevée

Publiée le 01/07/2026 à 20:16 · Modifiée le 02/07/2026 à 20:15 · Analysée par le NVD · Source : security@elastic.co

Description

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.0 Élevée	security@elastic.co	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-116

Références

https://discuss.elastic.co/t/kibana-7-17-15-8-11-1-security-update-esa-2026-53 Vendor AdvisoryMitigation

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories