CVE-2026-33460: Kibana Information Disclosure Vulnerability

CVE-2026-33460 Overview

CVE-2026-33460 is an Incorrect Authorization vulnerability (CWE-863) in Kibana that enables cross-space information disclosure through privilege abuse. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.

Critical Impact

Authenticated users with limited Fleet privileges can access sensitive Fleet Server policy information across multiple Kibana spaces, potentially exposing infrastructure details and operational configurations they should not have access to.

Affected Products

• Kibana versions prior to 8.19.14
• Kibana versions prior to 9.2.8
• Kibana versions prior to 9.3.3

Discovery Timeline

• 2026-04-08 - CVE-2026-33460 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-33460

Vulnerability Analysis

This authorization bypass vulnerability affects Kibana's Fleet Server integration, specifically within the internal enrollment endpoint handling mechanism. The flaw stems from improper access control implementation where space-scoped authorization checks are not properly enforced.

When a user with Fleet agent management privileges initiates a request to retrieve Fleet Server policy details, the internal enrollment endpoint processes this request using an unscoped internal client. This architectural decision bypasses the intended multi-tenancy isolation that Kibana spaces are designed to provide. As a result, the endpoint returns sensitive information including operational identifiers, policy names, management state, and infrastructure linkage details from spaces beyond the user's authorized scope.

The vulnerability represents a horizontal privilege escalation scenario where authenticated users can access data belonging to other organizational units or tenants within the same Kibana deployment.

Root Cause

The root cause of CVE-2026-33460 lies in the use of an unscoped internal client within the Fleet Server enrollment endpoint. Kibana spaces are designed to provide logical separation and access control boundaries between different organizational units or use cases. However, the internal enrollment endpoint fails to respect these boundaries because it utilizes an internal client that operates without space-scoping context.

This design flaw means that authorization checks performed at the API level do not propagate to the underlying data retrieval operations, allowing authenticated users to access Fleet policy data from any space regardless of their actual space-level permissions.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker would need:

1. Valid credentials to authenticate to the Kibana instance
2. Fleet agent management privileges in at least one Kibana space
3. Knowledge of or ability to enumerate other Kibana spaces

Once authenticated, the attacker can craft requests to the internal enrollment endpoint that return Fleet Server policy details from spaces they are not authorized to access. The attack does not require user interaction and can be performed programmatically.

The vulnerability does not allow modification or deletion of data (no integrity impact) and does not affect system availability. The impact is limited to unauthorized read access to Fleet policy information across space boundaries.

Detection Methods for CVE-2026-33460

Indicators of Compromise

• Unusual patterns of requests to Fleet enrollment endpoints from users with limited space access
• API access logs showing cross-space Fleet policy retrievals by single user accounts
• Anomalous access patterns where users query Fleet policies from spaces outside their normal operational scope

Detection Strategies

• Monitor Kibana audit logs for Fleet enrollment endpoint access patterns that span multiple spaces
• Implement alerting on users accessing Fleet Server policy data from spaces where they lack explicit permissions
• Review API access logs for enumeration attempts targeting Fleet policy endpoints
• Correlate user session data with space access patterns to identify potential abuse

Monitoring Recommendations

• Enable detailed audit logging for Fleet-related API endpoints in Kibana
• Configure alerts for access anomalies involving cross-space data retrieval attempts
• Regularly review user privilege assignments for Fleet agent management capabilities
• Implement SIEM rules to detect unusual Fleet policy access patterns across space boundaries

How to Mitigate CVE-2026-33460

Immediate Actions Required

• Upgrade Kibana to version 8.19.14, 9.2.8, or 9.3.3 or later immediately
• Review and audit current user permissions for Fleet agent management privileges
• Restrict Fleet management privileges to only users who require cross-space access
• Monitor logs for any suspicious cross-space Fleet policy access attempts

Patch Information

Elastic has released security updates to address this vulnerability. Organizations should upgrade to one of the following patched versions:

• Kibana 8.19.14 or later (for 8.x deployments)
• Kibana 9.2.8 or later (for 9.2.x deployments)
• Kibana 9.3.3 or later (for 9.3.x deployments)

For detailed patch information, refer to the Elastic Kibana Security Update (ESA-2026-25).

Workarounds

• Review and restrict Fleet agent management privileges to minimize exposure until patches can be applied
• Implement network segmentation to limit access to Kibana instances from untrusted networks
• Use reverse proxy rules to restrict access to Fleet enrollment endpoints if feasible
• Consider disabling Fleet functionality temporarily if not operationally required until the patch is deployed

# Review current Kibana version
curl -s "http://localhost:5601/api/status" | jq '.version.number'

# Check Kibana logs for Fleet endpoint access patterns
grep -E "fleet.*enrollment" /var/log/kibana/kibana.log

# Verify upgrade after patching
curl -s "http://localhost:5601/api/status" | jq '.version.number'
# Expected: 8.19.14, 9.2.8, or 9.3.3 or later