# CVE-2026-42401: Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection

> CVE-2026-42401: Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection. CVSS 4.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-42401
Last updated: 2026-10-14T20:10:00Z

- Published: 2026-05-28 19:40 UTC · Updated: 2026-10-14 20:10 UTC · Assigner: elastic
- CVSS: 4.1 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
- EPSS: 0.14%, 3th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-79

## Description

Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently sanitized. Successful exploitation could result in unauthorized UI manipulation and outbound network requests issued from the viewing user's browser session.

## Affected vendors and products

- Elastic: Kibana

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-42401)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-42401)
- [https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552](https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-security-update-esa-2026-34/386552)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-42401 · Markdown: https://rewindex.com/cve/CVE-2026-42401.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-42401 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T04:03:57.860Z