CVE-2026-33462

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana::::::::

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se identificó una vulnerabilidad de salto de ruta en la funcionalidad de gestión de paneles de control de Kibana. Un usuario autenticado con permisos limitados podría crear un panel de control con un identificador especialmente diseñado. Cuando un administrador posteriormente intenta eliminar este panel de control a través de la interfaz de Kibana, la solicitud de eliminación es redirigida a un punto final interno no intencionado, lo que podría resultar en la eliminación no autorizada de cuentas de usuario u otros recursos. La explotación requiere que un administrador realice una acción de eliminación en el objeto del panel de control creado maliciosamente.

Information

Published : 2026-05-28 20:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-33462

Mitre link : CVE-2026-33462

CVE.ORG link : CVE-2026-33462

JSON object : View

Products Affected

elastic

kibana

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-33462", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33462", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T14:55:36.765123Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.3.4"}, {"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.15"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-28T20:16:22.773", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de salto de ruta en la funcionalidad de gesti\u00f3n de paneles de control de Kibana. Un usuario autenticado con permisos limitados podr\u00eda crear un panel de control con un identificador especialmente dise\u00f1ado. Cuando un administrador posteriormente intenta eliminar este panel de control a trav\u00e9s de la interfaz de Kibana, la solicitud de eliminaci\u00f3n es redirigida a un punto final interno no intencionado, lo que podr\u00eda resultar en la eliminaci\u00f3n no autorizada de cuentas de usuario u otros recursos. La explotaci\u00f3n requiere que un administrador realice una acci\u00f3n de eliminaci\u00f3n en el objeto del panel de control creado maliciosamente."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EDC5B3-131D-489E-8447-05C5C599E6A7", "versionEndExcluding": "8.19.16", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9B40710-912A-4157-9F25-89CE26C098A9", "versionEndExcluding": "9.3.5", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}