CVE-2026-33462 Elastic CVE debrief

Who should care

Organizations running Kibana versions prior to 8.19.16 or 9.3.5 with multi-user deployments where low-privilege users can create dashboards and administrators routinely manage dashboard lifecycle. Security teams should prioritize patching and audit recent dashboard deletions for anomalous outcomes.

Technical summary

The vulnerability exists in Kibana's dashboard management functionality where insufficient input validation on dashboard identifiers allows path traversal sequences to be embedded. When an administrator attempts to delete a dashboard containing a crafted identifier, the application fails to properly sanitize or validate the identifier before constructing the deletion request, resulting in redirection to unintended internal endpoints. This can trigger operations beyond the intended dashboard deletion scope, such as user account deletion. The attack chain requires two distinct actors: a low-privilege attacker to plant the malicious object, and a privileged administrator to trigger the vulnerable code path through normal UI interaction.

Defensive priority

medium

Recommended defensive actions

• Upgrade Kibana to version 8.19.16 or 9.3.5 or later to address this vulnerability
• Review dashboard deletion audit logs for suspicious activity involving unexpected resource deletion
• Implement principle of least privilege for Kibana user accounts, limiting dashboard creation permissions where possible
• Monitor for unusual API endpoint access patterns following dashboard deletion operations
• Verify backup and recovery procedures for user accounts and critical resources are functional

Evidence notes

The vulnerability description indicates exploitation requires: (1) an authenticated user with limited permissions to create a specially crafted dashboard identifier, and (2) an administrator to subsequently delete that dashboard. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) confirms network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, with low impact to integrity and availability. CWE-22 (Path Traversal) is identified as the weakness type.

Official resources