What is CVE-2026-49096?

CVE-2026-49096 is a medium-severity vulnerability in Elastic Kibana, classified under CWE-248. CVSS score: 4.3/10. Published 2026-08-13.

How severe is CVE-2026-49096?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Elastic Kibana

CVE-2026-49096

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

Affected products

Elastic Kibana — versions 8.0.0, 9.0.0, 9.4.0

Weakness classification (CWE)

CWE-248

References

security@elastic.co

Frequently asked questions

What is CVE-2026-49096?: CVE-2026-49096 is a medium-severity vulnerability in Elastic Kibana, classified under CWE-248. CVSS score: 4.3/10. Published 2026-08-13.
How severe is CVE-2026-49096?: Medium severity. CVSS v3 base score is 4.3 out of 10.