EUVD-2026-33012CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently sanitized. Successful exploitation could result in unauthorized UI manipulation and outbound network requests issued from the viewing user's browser session.
AnalysisAI
Stored HTML injection in Kibana allows a low-privileged authenticated user with write access to an Elasticsearch index to persist crafted markup that is insufficiently sanitized when rendered in an affected Kibana view. When a second user opens the compromised view, their browser processes the unsanitized content, enabling unauthorized manipulation of the Kibana UI and issuing outbound network requests from the victim's browser session. …
Sign in for full analysis, threat intelligence, and remediation guidance.
More from same product – last 7 days
Server-side request forgery in Elastic Kibana allows authenticated users holding connector management privileges to bypa
Denial of service in Kibana allows any authenticated low-privileged user to render the Kibana service unresponsive for a
Privilege escalation in Elastic Kibana's Fleet agent policy management feature allows authenticated Fleet administrators
Expired access tokens in Kibana remain exploitable due to a logic error in expiration timestamp validation (CWE-672), al
Dashboard management path traversal in Elastic Kibana allows a low-privileged authenticated attacker to redirect adminis
Share
External POC / Exploit Code
Leaving vuln.today