CVE-2026-33461: Kibana Information Disclosure - 8.0.0-9.3.2

CVE-2026-33461 affects Kibana, leading to sensitive information disclosure due to incorrect authorization. A user with limited Fleet privileges can exploit an internal API endpoint to access confidential configuration data, including private keys and authentication tokens. This occurs because the API doesn't adequately verify permissions, allowing users with insufficient privileges to obtain information that should only be accessible to administrators with higher-level settings privileges. The potential impact is severe, as exposure of these credentials could compromise the security of the entire Elasticsearch and Kibana infrastructure, enabling unauthorized access to sensitive data and malicious actions.

1. Reserved2026-03-20
2. Published2026-04-08
3. Modified2026-04-09
4. EPSS updated2026-04-16

The solution to mitigate CVE-2026-33461 is to update Kibana to version 9.3.3 or later. This update corrects the vulnerability by implementing stricter authorization controls on the affected internal API. It is recommended to apply this update as soon as possible, especially in production environments. Additionally, review Fleet user privileges to ensure they only have access to necessary resources. Monitoring Kibana logs for suspicious activity related to the internal API can help detect and respond to potential exploitation attempts. Finally, implementing the principle of least privilege across all user roles is a good general security practice.