CVE-2026-49088
published 2026-07-01CVE-2026-49088: Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring…
PriorityP420medium4.4CVSS 3.1
AVNACHPRHUINSUCHINAN
EPSS
0.32%
24.1th percentile
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 8.0.0 < 8.18.9 | 8.18.9 |
| elastic | kibana | 8.0.0 – 8.18.8 | — |
| elastic | kibana | >= 8.19.0 < 8.19.6 | 8.19.6 |
| elastic | kibana | 8.19.0 – 8.19.5 | — |
| elastic | kibana | >= 9.0.0 < 9.0.8 | 9.0.8 |
| elastic | kibana | 9.0.0 – 9.0.7 | — |
| elastic | kibana | >= 9.1.0 < 9.1.6 | 9.1.6 |
| elastic | kibana | 9.1.0 – 9.1.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 8.18.8/8.19.5/9.0.7/9.1.5 Performance Monitor Page log file
vuldb·2026-07-01·CVSS 4.4
CVE-2026-49088 [MEDIUM] Elastic Kibana up to 8.18.8/8.19.5/9.0.7/9.1.5 Performance Monitor Page log file
A vulnerability was found in Elastic Kibana up to 8.18.8/8.19.5/9.0.7/9.1.5. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Performance Monitor Page. Executing a manipulation can lead to sensitive information in log files.
This vulnerability is registered as CVE-2026-49088. It is possible to launch the attack remotely. No exploit is available.
GHSA
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure.
ghsa_unreviewed·2026-07-01
CVE-2026-49088 [MEDIUM] CWE-532 Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure.
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-01
Published