CVE-2026-49096 Uncaught Exception in Kibana Cases Leading to Denial of Service

Medium 4.3 Published 13 Aug 2026 Updated 13 Aug 2026

An authenticated user can cause a denial of service in Kibana Cases by storing malformed link syntax in a comment, preventing case access for all users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-49096?

CVE-2026-49096 is a medium-severity denial of service vulnerability in Elastic Kibana, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected case from being displayed. An authenticated user holding privileges to comment on a case could store such a comment, after which that case became inaccessible to every user who opened it until the stored comment was removed.

Weakness: CWE-248

Which versions are affected by CVE-2026-49096?

2 open source packages ship an affected version, including kibana and elk. It affects 1 product.

Package	Affected	Fixed in
`kibana` Bitnami	From `8.0.0`	`8.19.20, 9.3.5, 9.4.2`
`elk` Bitnami	From `8.0.0`	`8.19.20, 9.3.5, 9.4.2`

Products include Elastic Kibana.

How do I fix CVE-2026-49096?

Upgrade kibana to a fixed version for your release line: 8.19.20, 9.3.5 or 9.4.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-49096 being exploited?

There is no known exploitation of CVE-2026-49096 in the wild and no public exploit code.

All Elastic Kibana vulnerabilities

Sources

Also known as BIT-elk-2026-49096, BIT-kibana-2026-49096, GHSA-448j-qxg7-vqm3, MINI-4xfc-gwpg-7c3q, MINI-ffgw-58h5-fvj3, MINI-gc6q-9h5h-9w96 and 4 more.