CVE-2026-42401

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Improper neutralization of input during web page generation allows for stored HTML injection. A user with write access to an Elasticsearch index can persist crafted markup that is not sufficiently sanitized when rendered through a Kibana view by another user. This can lead to unauthorized UI manipulation and outbound network requests issued from the browser session of the user viewing the content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.