CVE-2026-49096

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

Database specific

{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-248"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49096.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.19.19"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.3.4"
                },
                {
                    "introduced": "9.4.0"
                },
                {
                    "last_affected": "9.4.0"
                },
                {
                    "introduced": "9.4.1"
                },
                {
                    "last_affected": "9.4.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type

GIT

Repo

https://github.com/elastic/elasticsearch

Events

Introduced

1b6a7ece17463df5ff54a3e1302d825889aa1161

Fixed

91f5381ece296ddc32b554f997269478b9224af8

Introduced

112859b85d50de2a7e63f73c8fc70b99eea24291

Fixed

7dcc32bebba091844c0207f9dae8fda6c7d08542

Introduced

2e8528e92361c3399724226deaf2b46f933e925b

Fixed

c402c2b36d90eae29c0182f86bd9050fd0b746cc

Database specific

Show details

{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.19.20"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.3.5"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*

v9.4.0

v9.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49096.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "23074235914325468324376590861514089586",
                "98430579598318027407692933948030043385",
                "187050963769246900287150112416544450660",
                "214623411764654173647043302652335395077",
                "176453353204044914242382593509038157485",
                "213515830173899733296977817562856718047"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49096-d726701b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/7dcc32bebba091844c0207f9dae8fda6c7d08542",
        "target": {
            "file": "modules/apm/src/test/java/org/elasticsearch/telemetry/apm/RecordingOtelMeter.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "23074235914325468324376590861514089586",
                "98430579598318027407692933948030043385",
                "187050963769246900287150112416544450660",
                "214623411764654173647043302652335395077",
                "176453353204044914242382593509038157485",
                "213515830173899733296977817562856718047"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49096-edd41f68",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/c402c2b36d90eae29c0182f86bd9050fd0b746cc",
        "target": {
            "file": "modules/apm/src/test/java/org/elasticsearch/telemetry/apm/RecordingOtelMeter.java"
        }
    }
]

vanir_signatures_modified

"2026-09-04T08:06:26Z"

Git / github.com/elastic/kibana

Affected ranges

Type

GIT

Repo

https://github.com/elastic/kibana

Events

Introduced

57ca5e139a33dd2eed927ce98d8231a1f217cd15

Fixed

4036be744384423f261fcf74b1b99fd4d044dc97

Introduced

504d6bfa94cca17fabb76e06152c30c4f0c3efdd

Fixed

db396449a69d0613b0b4dc8b8e9789aa35504e0f

Introduced

b2e39752e03b56f48f51943214475ddba1f8e974

Fixed

ca34dedcfe614964fe236c237a023021da0a8665

Database specific

Show details

{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.19.20"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.3.5"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*

v9.4.0

v9.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49096.json"