PT-2026-31344 · Elastic · Kibana

Ismisepaul + 1 · Published 2026-04-08 · Updated 2026-04-13 · CVE-2026-33458

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions (affected versions not specified)

Description Kibana One Workflow contains a Server-Side Request Forgery (CWE-918) issue that can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-ELK-2026-33458

BIT-KIBANA-2026-33458

CVE-2026-33458

Affected Products

Kibana

References · 5

• https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33458 · Security Note
• https://osv.dev/vulnerability/BIT-kibana-2026-33458 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elk-2026-33458 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041975628879007984 · Twitter Post