CVE-2026-33460: Information Disclosure in Kibana

An attacker exploiting this vulnerability could gain unauthorized access to Fleet Server policy details, including operational identifiers, policy names, management state, and infrastructure linkage information from spaces where the user lacks proper authorization. This information could be used to map the Kibana environment, identify potential targets for further attacks, or exfiltrate sensitive data. While the vulnerability requires Fleet agent management privileges, the ability to bypass space-scoped access controls significantly expands the potential attack surface. The impact is particularly concerning in multi-tenant environments or where different spaces are used to isolate sensitive data.

1. Reserved2026-03-20
2. Published2026-04-08
3. Modified2026-04-09
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-33460 is to upgrade Kibana to version 9.3.3 or later, which contains the fix. If immediate upgrading is not possible, consider implementing stricter access controls within Kibana spaces to limit the scope of Fleet agent management privileges. Review existing Fleet Server policies to ensure they adhere to the principle of least privilege. While a WAF or proxy cannot directly prevent this vulnerability, they can be configured to monitor for suspicious requests targeting the internal enrollment endpoint and potentially block unauthorized access. After upgrading, confirm the fix by attempting to access Fleet Server policy details from a space where the user should not have access; the request should be denied.