Kibana CVE-2026-49091

Exploitation requires: (1) the attacker to have enough access to submit input that Kibana writes into its log files (CVSS PR:L - some authenticated/low-privilege foothold, not fully anonymous); (2) that input to reach a logged field without neutralization; and critically (3) a human operator (UI:R) to subsequently view the affected log in a terminal emulator that interprets control/escape sequences. Limiting factors: high attack complexity (AC:H), the dependency on operator interaction, and the fact that logs viewed through non-interpreting viewers or a web/SIEM UI are not affected. The impact is confined to manipulation of displayed log data (log forging/tampering) rather than direct system compromise.

Signals are mixed. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H = 8.0 High) rates all three impacts High with a scope change, which is aggressive for a log-forging weakness whose demonstrated effect is altering displayed log data rather than direct code execution - verify the C:H/I:H/A:H rating against the actual terminal impact. The vector itself already reflects meaningful friction: high attack complexity (AC:H), required privileges (PR:L), and required user interaction (UI:R, an operator must open the log in a vulnerable terminal). No EPSS score, SSVC decision, POC, or KEV entry is present in the provided data, so there is no evidence of active or automatable exploitation. Net: this is a real integrity/log-tampering concern for teams that inspect Kibana logs in a terminal, but the practical priority is moderate - a patch-on-normal-cycle item rather than an emergency, absent exploitation signals.

A low-privileged Kibana user submits a request whose parameters contain ANSI escape and carriage-return sequences engineered to be written into Kibana's logs. Later, a SOC analyst investigating activity runs 'tail'/'cat' on the log file in a terminal, at which point the injected sequences rewrite or conceal log lines - hiding the attacker's actions or planting misleading forged entries. No public POC is identified at time of analysis, and the attack depends on the analyst using a terminal that interprets control sequences.