CVE-2026-49088

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49088
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49088.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49088
Downstream
Published
2026-07-01T16:59:24Z
Modified
2026-08-12T16:25:32Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure
Details

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-532"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49088.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.18.8"
                },
                {
                    "introduced": "9.1.0"
                },
                {
                    "last_affected": "9.1.5"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.0.7"
                },
                {
                    "introduced": "8.19.0"
                },
                {
                    "last_affected": "8.19.5"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
93788a8c2882eb5b606510680fac214cff1c7a22
Fixed
d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b
Introduced
112859b85d50de2a7e63f73c8fc70b99eea24291
Fixed
936f7cf370e0d7952bb71a98629284c3c0e0d00e
Introduced
00e7d33bf08f1476229d9d1642e2da46cfebdd53
Fixed
382e36e0fbb3c0c80703cd48691ea265d7f931d9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.19.0"
        },
        {
            "fixed": "8.19.6"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.8"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.1.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v8.*
v8.19.0
v8.19.1
v8.19.2
v8.19.3
v8.19.4
v8.19.5
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.0.5
v9.0.6
v9.0.7
v9.1.0
v9.1.1
v9.1.2
v9.1.3
v9.1.4
v9.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49088.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "228463112010889429419902759370711287357",
            "length": 991
        },
        "id": "CVE-2026-49088-1447f33e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformRestTestCase.java",
            "function": "createContinuousPivotReviewsTransform"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "220138128263835138004505597070655140553",
                "260032333294360172791935320905844178520",
                "104055576244543251432532954542905744827"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-19dfa539",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/test/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformSchedulerTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "51931065017331368426895486459662273873",
                "47308352597334360594416014986334968554",
                "312595100117873595934692446522662781162"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-1a34ca75",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/transform/transforms/TransformConfigUpdate.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "266645240591898250239578510707230984388",
                "82804697213598913100879958145236188356",
                "58994721204518704242101208910129613573",
                "256763472873208358017445178523757252717",
                "315127580850675208806370743483659573944",
                "114259881863201862393001494162229930892",
                "245938960749814530641567903302790334814",
                "308398886237674947532404900271160276730"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-20c93e09",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/action/TransportUpdateTransformAction.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "172384026688835205343382322730454525799",
            "length": 705
        },
        "id": "CVE-2026-49088-37e754eb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java",
            "function": "processScheduledTasksInternal"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "333415736295793019594652476257514117934",
            "length": 3050
        },
        "id": "CVE-2026-49088-4811c567",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/action/TransportUpdateTransformAction.java",
            "function": "doExecute"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "193220272627582509876174252041656531139",
                "63119638354198043521921603017669004942",
                "11352659451477516971297679407951276543",
                "133603604418695799514536108758796383614",
                "95974249529822873339555564610882703736",
                "222521972629830176032697921702543628385",
                "14850311712212285978966006888245895658",
                "273047233299505141886218798036386174274",
                "4497068329305248967241435034606151771",
                "124448835358779502230725079811968153141",
                "260522515497262626972536549550302863043",
                "63341862177097745247872158065764130271",
                "1439747910630090566448614379044927956",
                "5467683363113127755500028285827207913",
                "37872675901657783201687107510212386566"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-4db601bc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformUpdateIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "185620469528429678572919397230684044211",
            "length": 494
        },
        "id": "CVE-2026-49088-56865771",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java",
            "function": "parseSemanticTextField"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "255075628869125026499779058897594092053",
            "length": 474
        },
        "id": "CVE-2026-49088-5a6e0e7d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java",
            "function": "testOldIndexSemanticTextDenseVectorRaisesError"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "331323253558194736856864026167107843654",
            "length": 126
        },
        "id": "CVE-2026-49088-5bb25224",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java",
            "function": "testOldIndexSemanticTextMinimalMappingRaisesError"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "304099916769792469380869096030645339333",
            "length": 65
        },
        "id": "CVE-2026-49088-5dded118",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java",
            "function": "boostNotAllowedIndexVersion"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "111033081395648281585922729778152242886",
            "length": 358
        },
        "id": "CVE-2026-49088-770243f8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java",
            "function": "scheduleNow"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "267199666692918951464956161165794057231",
            "length": 331
        },
        "id": "CVE-2026-49088-8a04da98",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java",
            "function": "handleTransformFailureCountChanged"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "146644383087728857266669708373084703291",
            "length": 506
        },
        "id": "CVE-2026-49088-8ff5b3dd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformUpdateIT.java",
            "function": "testUpdateThatChangesSettingsButNotHeaders"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "262359536888747167599175386963704603616",
            "length": 342
        },
        "id": "CVE-2026-49088-9b7721e5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java",
            "function": "registerTransform"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "151581543923528670693525823811555113136",
            "length": 1017
        },
        "id": "CVE-2026-49088-a1880001",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java",
            "function": "createEmbeddingsField"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "265566446207355487083800316557209907855",
            "length": 188
        },
        "id": "CVE-2026-49088-a8ddc947",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java",
            "function": "deregisterTransform"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "174083736236602742003276725892979681465",
            "length": 749
        },
        "id": "CVE-2026-49088-afeaa7f4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java",
            "function": "processScheduledTasks"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "117583213274205174497587231349471317292",
                "281282960127960796468285894292415939058",
                "125955058854776823760037136829169901635",
                "74999845152917614398080030315908258476",
                "21688007595450396843447088506982143865",
                "332986472108243883088802278366595710641",
                "91686121324245886435329523449374435840",
                "72164297190499882827866500419162156302",
                "184146702944016539709794010907822653225",
                "262022418539388469293701396785820530315",
                "69958710721988636201395573869574007543",
                "119999117392685937969217966355429936017",
                "230714909907580119087112796543793333416",
                "322147883672319350658494852172327619483",
                "336276199855455357637297684375058100826",
                "183649640018451177944359432202189321482",
                "95195926771742618102379767473037002839",
                "205087873135772979717381057667751428050",
                "212713060646384469092813494242940186225",
                "53575337692873230909575022552383358766",
                "1411086074569687251091004418324703260",
                "139100358459497246482740050860200416180",
                "293423948930554330019950786057044409980",
                "162271131592861911193325461652666586147",
                "294115082150365681696943272490789717000",
                "63117583094940197625394669503079580373",
                "21582040307577579715822091097117099757",
                "278601733198360744280614671883355807374",
                "154559738376034768036871436947317300947",
                "154999479800779627700219164957074405224",
                "139496772855743118104320859589153241347",
                "122568838817180295418801568473310838863",
                "105306485669418327016602726834264310014",
                "302271038905797176433697638977615368111",
                "121492526351967965056321370387779263554",
                "151119804561049904446604870755239462264"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-b1c1106d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/scheduling/TransformScheduler.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "192095868591587962532804350088891814436",
            "length": 331
        },
        "id": "CVE-2026-49088-d26afbef",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java",
            "function": "assertOldIndexUnsupported"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "298824596258705767720084127333401318764",
                "60777090447047163393008841398962827636",
                "225983623319095708201454384456872624480",
                "27631968513804404298811446726753334755",
                "78881977074430129307969534642410671905"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-d417ac64",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/qa/single-node-tests/src/javaRestTest/java/org/elasticsearch/xpack/transform/integration/TransformRestTestCase.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "158605217801375928217441734668045540378",
                "272643381640331013499760342031064134020",
                "53985671753460806937762457046134928512",
                "197421975884843474782424751932224498632",
                "147776267001273472201702975582528497363",
                "655409951843218362925480034532671518",
                "17637815016842550146136423455960159478",
                "74236008148083372658918307439668483975",
                "322466091450047313375256476185595762444",
                "19774709324117963877378806154921988126",
                "111332465234007377841077556799200761214",
                "318852455395922762541962253784569936542",
                "103714126231198070777385075505723872779",
                "225055423574406139145017039407710500808",
                "176602979872018362860366352636239272391",
                "331685485893499033920803751727008752008",
                "69845433180568037910725362514896432747",
                "288232291348711926876643238346416986777",
                "68055421170270233796912105902769502524",
                "94739273273727563438676562800551104982",
                "84737812370821697998231739337299621986",
                "115294157346707483202906366071384113569",
                "57212282134168748289652182660041201662",
                "254952007036070415382532317368308133681",
                "263203763916969629460590396437502289108",
                "22319423814347326997056951711072005097",
                "23504183291184894397124342894633566955",
                "218290195268039007322983453577677478937",
                "104397057306458966946420455493521049587",
                "108549254030958920501876829102082088797",
                "103602840545713796434731913178477290736",
                "288232291348711926876643238346416986777",
                "304973740810181194951592487929339496300",
                "130999337670170096176664372274476384929",
                "35867540676817589760895459391085052904",
                "207502979453752030282883390595778036424",
                "201606209583253241599127378006426619079",
                "196859472990790294633289504047629811096",
                "217941806944909312076984301808225946554",
                "262692938943554161674911701383004754029",
                "122608929037810719115677381049195131198",
                "266704451184192508078195140547635007709",
                "42779409025487380885093343877669921094",
                "113544207510783995041866812883656149640",
                "300270315494799500913741421782448457144",
                "186309500865517495853234544968794613882",
                "275404729970474416383790431094378410325",
                "52682000639465385863593790108573768318",
                "108301057757930837241470507337700244957",
                "8869584976956833588688363116094065733",
                "320322203024487798382973062775163554140"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-e273a1bd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "243501690235055055791391894636932221527",
            "length": 284
        },
        "id": "CVE-2026-49088-ee5722f0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/d2c42d91a1eb9e14b1a37c4d87eb2533ec859e2b",
        "target": {
            "file": "x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/action/TransportUpdateTransformAction.java",
            "function": "taskOperation"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "249765765527764254961865193665008504870",
            "length": 322
        },
        "id": "CVE-2026-49088-f11fdf3e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java",
            "function": "testOldIndexSemanticTextSparseVersionRaisesError"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "201659335253409180137227967538365490900",
                "289297698807500789849272724987309848331",
                "316947341018203027282186092977954478790",
                "328635304086144337324979246151558935664",
                "238267326037809942089416424725201504926",
                "239127309757472193571684981147742201173",
                "173339703316009130346461748428871974340",
                "320082339657603852603623259741426538034",
                "57118101550255153288139441993827008978",
                "268077932521070584832017352121249000075",
                "102348567805617495592268951805669974975",
                "11265192835822603210162801661360872060",
                "201173388829126597956002296588814084345",
                "337421580536504805651941451209477653214",
                "268075823910593805973861160404908247282",
                "9015906786740215991199765650853684422",
                "266988922029788668281231447512727939898",
                "172758342448755661431055717457301901038",
                "297612526677102816987940982488909026806",
                "210768804027509774644592109719262626729",
                "298123093271431276257578624524763682529",
                "80694905765248191373232040858301348148",
                "51188739959210038594042089674024249861",
                "187947718986999890631599988869822772770",
                "207105469192108996997706200474270770510",
                "151354268564102146974990964996402402639",
                "127423006876670033087290001592727022679",
                "275612146089253582203363595104868195677",
                "51748493963961357519758086343479074559",
                "200549291164040151494825744531332418306",
                "239196964213531434344185265450366252390",
                "329626261930251612650005244598332413438",
                "120105507997745074262955751379832286552",
                "34493630395322261406715696382503445314",
                "16871879890049855732250965867318795550",
                "114692002306916862615727736492928276000",
                "215412353412547025196509663532932782715",
                "335174381897296512391143356609878691466",
                "290996714066872469541389277716815248935",
                "333508862785924981954910392220880037432",
                "277647464754561137415646796304470856322"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49088-f599795d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "216429141669878661452070393933949020156",
            "length": 368
        },
        "id": "CVE-2026-49088-ff78991f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e",
        "target": {
            "file": "x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java",
            "function": "validateParserContext"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:32Z"

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
ffd7cbf34ac1234c78354f2a22ef5f1703c04eaf
Fixed
93caa41bf1dca66c8754156cd7819e2ceb980455
Introduced
504d6bfa94cca17fabb76e06152c30c4f0c3efdd
Fixed
16276053a4c29c654785bb35bce6b512c15435b1
Introduced
9f30374092edd41719399f7ef81cb7ae78d8a3ab
Fixed
fe461e4c2dd2d70d5890576919a218694f51eea3
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.19.0"
        },
        {
            "fixed": "8.19.6"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.8"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.1.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v8.*
v8.19.0
v8.19.1
v8.19.2
v8.19.3
v8.19.4
v8.19.5
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.0.5
v9.0.6
v9.0.7
v9.1.0
v9.1.1
v9.1.2
v9.1.3
v9.1.4
v9.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49088.json"