CVE-2026-49091CWE-116

Improper Output Neutralization for Logs in Kibana Leading to Log Injection

High · published July 1, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-07-01T17:21Z
EPSS history
Timeline
  • 01 JUL 17:21Z
    Improper Output Neutralization for Logs in Kibana Leading to Log Injection
    cvelistv5