CVE-2026-49096
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An uncaught exception in Kibana Cases can lead to denial of service via input data manipulation. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user with privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.
Risk Assessment
An attacker can permanently block access to specific cases in Kibana, disrupting teams that rely on this feature. Even a single malicious comment can make a case inaccessible to all users, leading to operational downtime.
Recommendation
Apply the Kibana update that includes a fix for this vulnerability. Additionally, restrict commenting privileges to trusted users and monitor comments for suspicious syntax.
Original NVD description (English source)
Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.