PT-2026-44489 · Elastic · Kibana

Ismisepaul + 1 · Published 2026-05-28 · Updated 2026-06-01 · CVE-2026-33462

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description A path traversal issue exists in the dashboard management functionality. An authenticated user with limited permissions can create a dashboard using a specially crafted identifier. If an administrator attempts to delete this dashboard, the request is redirected to an unintended internal endpoint, which may lead to the unauthorized deletion of user accounts or other resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-ELK-2026-33462

BIT-KIBANA-2026-33462

CVE-2026-33462

Affected Products

Kibana

References · 4

• https://osv.dev/vulnerability/BIT-kibana-2026-33462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33462 · Security Note
• https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-30/386545 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-elk-2026-33462 · Vendor Advisory