CVE catalog

CVE-2026-49088

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitiv

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpekibanaNot reported8.18.9fixed
CpekibanaNot reported8.19.6fixed
CpekibanaNot reported9.0.8fixed
CpekibanaNot reported9.1.6fixed
CpekibanaNot reported9.1.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpekibanacpeNot reported8.18.9Not reportedNot reportedNot reported
CpekibanacpeNot reported8.19.6Not reportedNot reportedNot reported
CpekibanacpeNot reported9.0.8Not reportedNot reportedNot reported
CpekibanacpeNot reported9.1.6Not reportedNot reportedNot reported
CpekibanacpeNot reported9.1.6Not reportedNVD-CVE-2026-49088Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]