What is the CVSS score of CVE-2026-33460?

CVE-2026-33460 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Kibana CVE-2026-33460

EUVD-2026-20523 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-08 elastic

GHSA-998c-7hf5-g249

Authentication Bypass Elastic Information Disclosure Kibana

4.3

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (elastic) · only source for this CVE.

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 17:16 euvd

EUVD-2026-20523

Analysis Generated

Apr 08, 2026 - 17:16 vuln.today

CVE Published

Apr 08, 2026 - 16:43 nvd

MEDIUM 4.3

DescriptionCVE.org

Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.

AnalysisAI

Kibana's Fleet agent management endpoint fails to enforce space-scoped access controls, allowing authenticated users with Fleet privileges in one space to retrieve sensitive Fleet Server policy details from unauthorized spaces including policy names, operational identifiers, and infrastructure linkage information. The vulnerability affects Kibana across multiple versions and requires valid user authentication with Fleet agent management permissions, resulting in cross-space information disclosure without the ability to modify data.

Technical ContextAI

Kibana's multi-tenancy architecture uses spaces to segregate user access and data visibility. The vulnerability exists in an internal enrollment endpoint used by Fleet agents to retrieve policy configurations. The endpoint uses an unscoped internal client (likely instantiated without space context) rather than enforcing space-scoped access controls through Kibana's authorization framework. This allows the endpoint to bypass the authorization checks that normally restrict users to their assigned space. CWE-863 (Incorrect Authorization) identifies the root cause: the system fails to verify that the authenticated user has permission to access resources in the requested space before returning sensitive Fleet Server configuration details.

RemediationAI

Update Kibana to the patched version specified in Elastic Security Update ESA-2026-25 (https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813), which includes fixed versions 8.19.14, 9.2.8, and 9.3.3 or later depending on your deployment track. The primary fix enforces space-scoped authorization checks on the internal enrollment endpoint to prevent unauthenticated cross-space policy retrieval. If immediate patching is not possible, restrict network access to the Kibana Fleet enrollment endpoint to trusted Fleet servers only, and audit Kibana logs for suspicious policy retrieval requests from users accessing spaces outside their authorized scope.