PT-2026-31334 · Elastic · Kibana

Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-33461

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description An issue exists in Kibana where incorrect authorization can lead to information disclosure through privilege abuse. A user with limited Fleet privileges can exploit an internal API endpoint to retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to users with higher-level settings privileges. The endpoint constructs its response by fetching full configuration objects and returning them directly, bypassing authorization checks enforced by dedicated settings APIs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-ELK-2026-33461

BIT-KIBANA-2026-33461

CVE-2026-33461

Affected Products

Kibana

References · 6

• https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-24/385812 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kibana-2026-33461 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elk-2026-33461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33461 · Security Note
• https://twitter.com/CVEnew/status/2041975634742640693 · Twitter Post
• https://t.me/CVEtracker/50078 · Telegram Post