Improper Input Neutralization in Kibana by Elastic

CVE-2026-42401

What is CVE-2026-42401?

A security issue in Kibana allows for improper neutralization of input during web page generation. Users with write access to an Elasticsearch index can insert malicious HTML markup, which can be rendered in the UI without proper sanitization when viewed by others. This could lead to unauthorized manipulation of the user interface and may allow attackers to initiate outbound network requests from the browser session of affected users.

References