{"id":"CVE-2026-49088","summary":"Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure","details":"Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.","modified":"2026-08-12T16:25:32.521140Z","published":"2026-07-01T16:59:24.086Z","database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-532"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49088.json","unresolved_ranges":[{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.18.8"},{"introduced":"9.1.0"},{"last_affected":"9.1.5"},{"introduced":"9.0.0"},{"last_affected":"9.0.7"},{"introduced":"8.19.0"},{"last_affected":"8.19.5"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-18-9-8-19-6-9-0-8-9-1-6-security-update-esa-2026-50"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49088.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49088"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"93788a8c2882eb5b606510680fac214cff1c7a22"},{"fixed":"d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b"},{"introduced":"112859b85d50de2a7e63f73c8fc70b99eea24291"},{"fixed":"936f7cf370e0d7952bb71a98629284c3c0e0d00e"},{"introduced":"00e7d33bf08f1476229d9d1642e2da46cfebdd53"},{"fixed":"382e36e0fbb3c0c80703cd48691ea265d7f931d9"}],"database_specific":{"extracted_events":[{"introduced":"8.19.0"},{"fixed":"8.19.6"},{"introduced":"9.0.0"},{"fixed":"9.0.8"},{"introduced":"9.1.0"},{"fixed":"9.1.6"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*"}}],"versions":["v8.19.5","v9.1.5","v9.1.4","v8.19.4","v9.0.7","v8.19.3","v9.1.3","v9.0.6","v9.1.2","v8.19.2","v9.0.5","v8.19.1","v9.1.1","v9.1.0","v8.19.0","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49088.json","vanir_signatures_modified":"2026-08-12T16:25:32Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"228463112010889429419902759370711287357","length":991},"id":"CVE-2026-49088-1447f33e","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformRestTestCase.java","function":"createContinuousPivotReviewsTransform"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/test/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformSchedulerTests.java"},"deprecated":false,"digest":{"line_hashes":["220138128263835138004505597070655140553","260032333294360172791935320905844178520","104055576244543251432532954542905744827"],"threshold":0.9},"id":"CVE-2026-49088-19dfa539"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/TransformConfigUpdate.java"},"deprecated":false,"digest":{"line_hashes":["51931065017331368426895486459662273873","47308352597334360594416014986334968554","312595100117873595934692446522662781162"],"threshold":0.9},"id":"CVE-2026-49088-1a34ca75","signature_type":"Line"},{"id":"CVE-2026-49088-20c93e09","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/action/TransportUpdateTransformAction.java"},"deprecated":false,"digest":{"line_hashes":["266645240591898250239578510707230984388","82804697213598913100879958145236188356","58994721204518704242101208910129613573","256763472873208358017445178523757252717","315127580850675208806370743483659573944","114259881863201862393001494162229930892","245938960749814530641567903302790334814","308398886237674947532404900271160276730"],"threshold":0.9}},{"target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java","function":"processScheduledTasksInternal"},"deprecated":false,"digest":{"length":705,"function_hash":"172384026688835205343382322730454525799"},"id":"CVE-2026-49088-37e754eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b"},{"deprecated":false,"digest":{"length":3050,"function_hash":"333415736295793019594652476257514117934"},"id":"CVE-2026-49088-4811c567","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/action/TransportUpdateTransformAction.java","function":"doExecute"}},{"id":"CVE-2026-49088-4db601bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformUpdateIT.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["193220272627582509876174252041656531139","63119638354198043521921603017669004942","11352659451477516971297679407951276543","133603604418695799514536108758796383614","95974249529822873339555564610882703736","222521972629830176032697921702543628385","14850311712212285978966006888245895658","273047233299505141886218798036386174274","4497068329305248967241435034606151771","124448835358779502230725079811968153141","260522515497262626972536549550302863043","63341862177097745247872158065764130271","1439747910630090566448614379044927956","5467683363113127755500028285827207913","37872675901657783201687107510212386566"]}},{"id":"CVE-2026-49088-56865771","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"parseSemanticTextField"},"deprecated":false,"digest":{"length":494,"function_hash":"185620469528429678572919397230684044211"}},{"id":"CVE-2026-49088-5a6e0e7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"function":"testOldIndexSemanticTextDenseVectorRaisesError","file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"function_hash":"255075628869125026499779058897594092053","length":474}},{"deprecated":false,"digest":{"function_hash":"331323253558194736856864026167107843654","length":126},"id":"CVE-2026-49088-5bb25224","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextMinimalMappingRaisesError"}},{"target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"boostNotAllowedIndexVersion"},"deprecated":false,"digest":{"function_hash":"304099916769792469380869096030645339333","length":65},"id":"CVE-2026-49088-5dded118","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e"},{"source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"function":"scheduleNow","file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java"},"deprecated":false,"digest":{"function_hash":"111033081395648281585922729778152242886","length":358},"id":"CVE-2026-49088-770243f8","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"267199666692918951464956161165794057231","length":331},"id":"CVE-2026-49088-8a04da98","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java","function":"handleTransformFailureCountChanged"},"deprecated":false},{"source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"function":"testUpdateThatChangesSettingsButNotHeaders","file":"x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformUpdateIT.java"},"deprecated":false,"digest":{"function_hash":"146644383087728857266669708373084703291","length":506},"id":"CVE-2026-49088-8ff5b3dd","signature_type":"Function","signature_version":"v1"},{"target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java","function":"registerTransform"},"deprecated":false,"digest":{"function_hash":"262359536888747167599175386963704603616","length":342},"id":"CVE-2026-49088-9b7721e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b"},{"source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"createEmbeddingsField"},"deprecated":false,"digest":{"function_hash":"151581543923528670693525823811555113136","length":1017},"id":"CVE-2026-49088-a1880001","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java","function":"deregisterTransform"},"deprecated":false,"digest":{"function_hash":"265566446207355487083800316557209907855","length":188},"id":"CVE-2026-49088-a8ddc947","signature_type":"Function","signature_version":"v1"},{"target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java","function":"processScheduledTasks"},"deprecated":false,"digest":{"length":749,"function_hash":"174083736236602742003276725892979681465"},"id":"CVE-2026-49088-afeaa7f4","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b"},{"deprecated":false,"digest":{"line_hashes":["117583213274205174497587231349471317292","281282960127960796468285894292415939058","125955058854776823760037136829169901635","74999845152917614398080030315908258476","21688007595450396843447088506982143865","332986472108243883088802278366595710641","91686121324245886435329523449374435840","72164297190499882827866500419162156302","184146702944016539709794010907822653225","262022418539388469293701396785820530315","69958710721988636201395573869574007543","119999117392685937969217966355429936017","230714909907580119087112796543793333416","322147883672319350658494852172327619483","336276199855455357637297684375058100826","183649640018451177944359432202189321482","95195926771742618102379767473037002839","205087873135772979717381057667751428050","212713060646384469092813494242940186225","53575337692873230909575022552383358766","1411086074569687251091004418324703260","139100358459497246482740050860200416180","293423948930554330019950786057044409980","162271131592861911193325461652666586147","294115082150365681696943272490789717000","63117583094940197625394669503079580373","21582040307577579715822091097117099757","278601733198360744280614671883355807374","154559738376034768036871436947317300947","154999479800779627700219164957074405224","139496772855743118104320859589153241347","122568838817180295418801568473310838863","105306485669418327016602726834264310014","302271038905797176433697638977615368111","121492526351967965056321370387779263554","151119804561049904446604870755239462264"],"threshold":0.9},"id":"CVE-2026-49088-b1c1106d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"assertOldIndexUnsupported"},"deprecated":false,"digest":{"function_hash":"192095868591587962532804350088891814436","length":331},"id":"CVE-2026-49088-d26afbef"},{"source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformRestTestCase.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["298824596258705767720084127333401318764","60777090447047163393008841398962827636","225983623319095708201454384456872624480","27631968513804404298811446726753334755","78881977074430129307969534642410671905"]},"id":"CVE-2026-49088-d417ac64","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["158605217801375928217441734668045540378","272643381640331013499760342031064134020","53985671753460806937762457046134928512","197421975884843474782424751932224498632","147776267001273472201702975582528497363","655409951843218362925480034532671518","17637815016842550146136423455960159478","74236008148083372658918307439668483975","322466091450047313375256476185595762444","19774709324117963877378806154921988126","111332465234007377841077556799200761214","318852455395922762541962253784569936542","103714126231198070777385075505723872779","225055423574406139145017039407710500808","176602979872018362860366352636239272391","331685485893499033920803751727008752008","69845433180568037910725362514896432747","288232291348711926876643238346416986777","68055421170270233796912105902769502524","94739273273727563438676562800551104982","84737812370821697998231739337299621986","115294157346707483202906366071384113569","57212282134168748289652182660041201662","254952007036070415382532317368308133681","263203763916969629460590396437502289108","22319423814347326997056951711072005097","23504183291184894397124342894633566955","218290195268039007322983453577677478937","104397057306458966946420455493521049587","108549254030958920501876829102082088797","103602840545713796434731913178477290736","288232291348711926876643238346416986777","304973740810181194951592487929339496300","130999337670170096176664372274476384929","35867540676817589760895459391085052904","207502979453752030282883390595778036424","201606209583253241599127378006426619079","196859472990790294633289504047629811096","217941806944909312076984301808225946554","262692938943554161674911701383004754029","122608929037810719115677381049195131198","266704451184192508078195140547635007709","42779409025487380885093343877669921094","113544207510783995041866812883656149640","300270315494799500913741421782448457144","186309500865517495853234544968794613882","275404729970474416383790431094378410325","52682000639465385863593790108573768318","108301057757930837241470507337700244957","8869584976956833588688363116094065733","320322203024487798382973062775163554140"],"threshold":0.9},"id":"CVE-2026-49088-e273a1bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"243501690235055055791391894636932221527","length":284},"id":"CVE-2026-49088-ee5722f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b","target":{"file":"x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/action/TransportUpdateTransformAction.java","function":"taskOperation"}},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextSparseVersionRaisesError"},"deprecated":false,"digest":{"function_hash":"249765765527764254961865193665008504870","length":322},"id":"CVE-2026-49088-f11fdf3e","signature_type":"Function"},{"target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["201659335253409180137227967538365490900","289297698807500789849272724987309848331","316947341018203027282186092977954478790","328635304086144337324979246151558935664","238267326037809942089416424725201504926","239127309757472193571684981147742201173","173339703316009130346461748428871974340","320082339657603852603623259741426538034","57118101550255153288139441993827008978","268077932521070584832017352121249000075","102348567805617495592268951805669974975","11265192835822603210162801661360872060","201173388829126597956002296588814084345","337421580536504805651941451209477653214","268075823910593805973861160404908247282","9015906786740215991199765650853684422","266988922029788668281231447512727939898","172758342448755661431055717457301901038","297612526677102816987940982488909026806","210768804027509774644592109719262626729","298123093271431276257578624524763682529","80694905765248191373232040858301348148","51188739959210038594042089674024249861","187947718986999890631599988869822772770","207105469192108996997706200474270770510","151354268564102146974990964996402402639","127423006876670033087290001592727022679","275612146089253582203363595104868195677","51748493963961357519758086343479074559","200549291164040151494825744531332418306","239196964213531434344185265450366252390","329626261930251612650005244598332413438","120105507997745074262955751379832286552","34493630395322261406715696382503445314","16871879890049855732250965867318795550","114692002306916862615727736492928276000","215412353412547025196509663532932782715","335174381897296512391143356609878691466","290996714066872469541389277716815248935","333508862785924981954910392220880037432","277647464754561137415646796304470856322"],"threshold":0.9},"id":"CVE-2026-49088-f599795d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e"},{"deprecated":false,"digest":{"function_hash":"216429141669878661452070393933949020156","length":368},"id":"CVE-2026-49088-ff78991f","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"function":"validateParserContext","file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"}}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"ffd7cbf34ac1234c78354f2a22ef5f1703c04eaf"},{"fixed":"93caa41bf1dca66c8754156cd7819e2ceb980455"},{"introduced":"504d6bfa94cca17fabb76e06152c30c4f0c3efdd"},{"fixed":"16276053a4c29c654785bb35bce6b512c15435b1"},{"introduced":"9f30374092edd41719399f7ef81cb7ae78d8a3ab"},{"fixed":"fe461e4c2dd2d70d5890576919a218694f51eea3"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.19.0"},{"fixed":"8.19.6"},{"introduced":"9.0.0"},{"fixed":"9.0.8"},{"introduced":"9.1.0"},{"fixed":"9.1.6"}]}}],"versions":["v8.19.5","v9.1.5","v9.1.4","v8.19.4","v9.0.7","v9.1.2","v8.19.3","v9.0.6","v9.1.3","v8.19.2","v9.0.5","v8.19.1","v9.1.1","v9.1.0","v8.19.0","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49088.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"}]}