What is the CVSS score of CVE-2026-33461?

CVE-2026-33461 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Kibana are affected by CVE-2026-33461?

CVE-2026-33461 affects Elastic Kibana and permits authenticated users with limited Fleet privileges to bypass authorization controls and access sensitive configuration data including private keys and…

How to fix or mitigate CVE-2026-33461?

Within 24 hours: Identify all Kibana instances in your environment and document their network accessibility and user privilege levels. Within 7 days: Restrict network access to Kibana to trusted networks only using firewall rules or reverse proxy authentication; audit Fleet privilege assignments and revoke unnecessary access. Within 30 days: Monitor Elastic's security advisories for patch availability and establish a patching timeline; conduct credential rotation for all private keys and tokens stored in Kibana configurations as a precautionary measure.

Kibana CVE-2026-33461

EUVD-2026-20525 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-08 elastic

GHSA-jf72-2wmj-p2f3

Authentication Bypass Elastic Information Disclosure Kibana

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 22:23 NVD

HIGH MEDIUM

CVSS changed

Jul 24, 2026 - 22:23 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Re-analysis Queued

Apr 22, 2026 - 16:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 17:16 euvd

EUVD-2026-20525

Analysis Generated

Apr 08, 2026 - 17:16 vuln.today

CVE Published

Apr 08, 2026 - 16:41 nvd

HIGH 7.7

DescriptionNVD

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint composes its response by fetching full configuration objects and returning them directly, bypassing the authorization checks enforced by the dedicated settings APIs.

AnalysisAI

Authorization bypass in Elastic Kibana allows authenticated users with limited Fleet privileges to retrieve sensitive configuration data including private keys and authentication tokens through an internal API endpoint. The vulnerability affects network-accessible instances and bypasses intended privilege boundaries by returning full configuration objects without proper authorization checks. CVSS score of 7.7 reflects high confidentiality impact with scope change. No public exploit identified at time of analysis, though the attack vector is straightforward for authenticated users.

Technical ContextAI

This vulnerability stems from an Incorrect Authorization weakness (CWE-863) in Kibana's Fleet management API implementation. The affected internal API endpoint fails to enforce proper authorization controls when composing responses, directly returning complete configuration objects that include sensitive data such as cryptographic private keys and authentication tokens. The flaw represents a classic privilege escalation scenario where the API trusts the caller's initial authentication but fails to verify sufficient authorization for the sensitive data being accessed. Unlike the dedicated settings APIs which properly enforce role-based access controls requiring higher-level settings privileges, this internal endpoint bypasses these checks entirely. The vulnerability exploits the common anti-pattern of fetching comprehensive data objects and returning them wholesale rather than filtering based on the caller's privilege level, enabling CAPEC-122 Privilege Abuse attacks where lower-privileged Fleet users can access data intended only for administrators or users with explicit settings management permissions.

RemediationAI

Upgrade to the vendor-released patched versions immediately: Kibana 8.19.14 for 8.x deployments, 9.2.8 for 9.2.x series, or 9.3.3 for 9.3.x series as specified in Elastic Security Advisory ESA-2026-24 available at https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-24/385812. The patches implement proper authorization checks on the internal API endpoint to enforce privilege boundaries consistent with dedicated settings APIs. As an interim mitigation for environments where immediate patching is not feasible, restrict network access to Kibana instances to trusted networks only and conduct an audit of Fleet privilege assignments to ensure least-privilege principles are enforced. Review access logs for suspicious API activity from users with Fleet privileges accessing configuration endpoints, particularly focusing on requests to internal API paths that return configuration data. Rotate any private keys and authentication tokens that may have been exposed if unauthorized access is suspected, and implement network segmentation to limit the scope of potential credential compromise.