What is the CVSS score of CVE-2026-33462?

CVE-2026-33462 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Kibana CVE-2026-33462

EUVD-2026-33009 MEDIUM

Path Traversal (CWE-22)

2026-05-28 elastic

GHSA-3j7x-jqgv-84cm

Path Traversal Elastic

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 20:26 vuln.today

DescriptionCVE.org

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.

AnalysisAI

Dashboard management path traversal in Elastic Kibana allows a low-privileged authenticated attacker to redirect administrative delete operations to unintended internal endpoints, potentially causing unauthorized deletion of user accounts or other Kibana-managed resources. Elastic's advisory ESA-2026-30 identifies fixes in versions 8.19.16 and 9.3.5, confirming the issue spans both active release branches. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact of silent account deletion warrants prioritized patching in multi-tenant deployments.

Technical ContextAI

Kibana is Elastic's browser-based analytics and visualization platform sitting atop Elasticsearch. CWE-22 (Path Traversal) identifies the root cause: the dashboard deletion handler constructs an internal API request using an attacker-controlled dashboard identifier without sufficient sanitization or validation. By embedding path traversal sequences in a dashboard ID or name at creation time, the attacker poisons the resource reference so that a subsequent server-side delete operation traverses to an unintended internal endpoint - such as a user account management API - rather than the dashboard itself. The CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* indicates no version is excluded from the affected range prior to the patched releases, covering both the 8.x and 9.x product lines.

RemediationAI

The primary fix is upgrading Kibana to version 8.19.16 (for 8.x deployments) or 9.3.5 (for 9.x deployments) as specified in Elastic security advisory ESA-2026-30, available at https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545. For environments where immediate patching is not feasible, the most targeted compensating control is restricting the dashboard Create privilege in Kibana role management to only vetted, trusted personnel - this removes the attacker's ability to plant a malicious dashboard object in the first place, though it may impact collaboration in shared Kibana Spaces and should be communicated to affected teams. Additionally, administrators should treat deletion of unexpected or unfamiliar dashboards - particularly those created by low-privilege accounts - with elevated scrutiny and verify object identity before proceeding. No workaround fully eliminates risk without patching, as the flaw resides in server-side request construction. Vendor-released patch: 8.19.16 / 9.3.5.