CVE-2026-49088
Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure
Description
Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.
INFO
Published Date :
July 1, 2026, 4:59 p.m.
Last Modified :
July 1, 2026, 4:59 p.m.
Remotely Exploit :
Yes !
Source :
elastic
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 271b6943-45a9-4f3a-ab4e-976f3fa05b5a | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Disable optional APM instrumentation if not required.
- Configure logging to exclude sensitive header values.
- Restrict access to application log files.
- Review and sanitize existing log data.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-49088 vulnerability anywhere in the article.