VulnerabilityAnalyzed
CVE-2026-49088
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure.
MEDIUM 4.4EPSS 0.32%
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
- CVSS 3.1
- 4.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.32% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-532
- Affected
- elastic/kibana
- Source
- security@elastic.co
References
- https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50Vendor Advisory, Mitigation
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.