Inclusion of Sensitive Information in Log Files in Kibana - CVE-2026-49088
Published: July 2, 2026
Vulnerability identifier: #VU136677
CSH Severity: Low
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49088
CWE-ID: CWE-532
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log file in Kibana APM instrumentation when handling requests with sensitive header values. A remote privileged user can send requests that include sensitive header values to disclose sensitive information.
Only deployments with the optional application performance monitoring instrumentation enabled are vulnerable, and exposed data may be accessible to operators with log access.
Affected software
Kibana
How to mitigate CVE-2026-49088
Install security update from vendor's website.
Kibana - addressed in versions 8.19.6, 9.0.8, 9.1.6