Skip to content
OpenAdvisories
Medium WID-SEC-2026-1029 5 CVEs

Kibana: Mehrere Schwachstellen

Published Apr 8, 2026 · Updated Apr 8, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kibana ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Kibana ist ein Open Source Datenvisualisierungs-Plugin für Elasticsearch.

Vulnerabilities 5

  • High 7.7
    CVE-2026-33461

    Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

    Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and auth…

    Elastic Kibana
  • High 7.7
    CVE-2026-4498

    Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope

    Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-f…

    Elastic Kibana
  • Medium 6.8
    CVE-2026-33458

    Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

    Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposi…

    Elastic Kibana
  • Medium 6.5
    CVE-2026-33459

    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input valu…

    Elastic Kibana
  • Medium 4.3
    CVE-2026-33460

    Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

    Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an…

    Elastic Kibana

Revision history

  1. #1

    Initiale Fassung

References