CVE-2026-33462
HIGH EPSS 12.8%
Published May 28, 20261mo ago · Modified Jun 17, 20261w ago
7.3 CVSS 3.1
Published May 28, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
12.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-22 Path Traversal Resource Mgmt
Affected Products 2
References 1
- discuss.elastic.co https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.