What is the CVSS score of CVE-2026-49088?

CVE-2026-49088 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-49088

EUVD-2026-41093 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-07-01 security@elastic.co

GHSA-r35r-rm7g-v9m8

Information Disclosure Elastic Kibana

4.4

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.4 MEDIUM

APM is non-default (AC:H), log read access requires operator privilege (PR:H), and impact is limited to confidentiality of captured header values with no integrity or availability effect.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:42 vuln.today

DescriptionCVE.org

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.

AnalysisAI

Sensitive HTTP request header values are written into Kibana application logs when the optional APM (Application Performance Monitoring) instrumentation feature is enabled, exposing credentials or tokens to anyone with operator-level log access. This affects multiple Kibana release branches (8.18.x, 8.19.x, 9.0.x, and 9.1.x) and is classified as information disclosure under CWE-532. No public exploit or active exploitation has been identified at time of analysis; the exposure is passive and gated behind both a non-default configuration and existing operator privileges.

Technical ContextAI

Kibana is the web-based analytics and visualization frontend for the Elastic Stack, widely deployed in enterprise logging, SIEM, and observability pipelines. CWE-532 describes the unintended insertion of sensitive data into log files - in this case, Kibana's optional APM instrumentation hooks into the HTTP request processing pipeline to gather performance telemetry. A flaw in this instrumentation causes raw request header values (which may contain Authorization headers, API keys, or session tokens) to be captured and persisted into application log output. Because APM is an opt-in feature and not enabled by default, the exposure is scoped to deployments that have explicitly activated it. The CVSS vector AV:N/AC:H/PR:H reflects that the product is network-accessible and that the data originates from network requests, while the high privilege and complexity requirements reflect the gating conditions: non-default APM configuration and existing log-read access.

RemediationAI

Upgrade Kibana to one of the patched versions released by Elastic: 8.18.9, 8.19.6, 9.0.8, or 9.1.6, per advisory ESA-2026-50 at https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50. As an interim compensating control, disabling APM instrumentation entirely eliminates the exposure - this is a viable workaround for deployments that do not depend on APM telemetry, with the trade-off of losing performance monitoring visibility. Additionally, review and rotate any Authorization headers, API keys, or session tokens that may have been captured in logs while APM was active. Restrict log access to the minimum required operators and audit existing log retention policies to reduce the window during which exposed header values remain accessible.