PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42401 Elastic CVE debrief

A stored HTML injection vulnerability in Kibana allows users with write access to an Elasticsearch index to persist unsanitized markup. When another user views affected Kibana views, the crafted content renders without adequate sanitization, potentially enabling unauthorized UI manipulation and outbound network requests from the victim's browser session. The vulnerability stems from improper neutralization of input during web page generation (CWE-79). Elastic has addressed this in Kibana versions 8.19.1 and 6.9.3-5 per their security advisory ESA-2026-34.

Vendor
Elastic
Product
Kibana
CVSS
MEDIUM 4.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Kibana with multi-user Elasticsearch environments where index-level access controls are shared among users with varying trust levels. Security teams monitoring for stored injection attacks in data visualization platforms. Compliance teams tracking XSS vulnerabilities in analytics infrastructure.

Technical summary

The vulnerability exists in Kibana's rendering of content from Elasticsearch indices. A user with index write permissions can store crafted HTML markup that Kibana subsequently renders without sufficient sanitization. The CVSS 3.1 score of 4.1 (Medium) reflects the required user interaction and limited scope of impact. Successful exploitation requires: (1) attacker with write access to an Elasticsearch index, (2) victim with access to view the affected Kibana visualization or dashboard, and (3) victim interaction with the rendered content. The attack can result in UI defacement, session manipulation, or triggering unauthorized outbound requests from the victim's browser.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Kibana to version 8.19.1, 6.9.3-5, or later as specified in the Elastic security advisory
  • Review Elasticsearch index permissions to restrict write access to trusted users only
  • Implement Content Security Policy headers to mitigate impact of HTML injection
  • Monitor Kibana access logs for unusual outbound network request patterns
  • Audit existing Elasticsearch indices for potentially malicious stored markup

Evidence notes

The vulnerability description and affected product identification are sourced from the official Elastic security advisory and NVD record. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) indicates network attack vector with low attack complexity, requiring low privileges and user interaction, with scope change and low integrity impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42401 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42401

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42401 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42401

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.