CVE-2026-33460: 
Kibana vulnerability analysis and mitigation

CVE-2026-33460 is an Incorrect Authorization vulnerability (CWE-863) in Elastic Kibana that enables cross-space information disclosure via privilege abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint that bypasses space-scoped access controls. Affected versions include Kibana 8.0.0–8.19.13, 9.0.0–9.2.7, and 9.3.0–9.3.2. The vulnerability was published on April 8, 2026, with patches released in versions 8.19.14, 9.2.8, and 9.3.3. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Elastic Advisory).

The root cause is an internal Fleet enrollment endpoint that uses an unscoped internal Elasticsearch client instead of a space-aware client, effectively bypassing Kibana's space-level access control model (CWE-863). An authenticated attacker with Fleet agent management privileges in any Kibana space can craft requests to this internal endpoint to query Fleet Server policy data belonging to other spaces. No elevated system privileges or user interaction are required beyond the Fleet agent management role, making the attack straightforward for any user holding that role. No public proof-of-concept code has been identified (GitHub Advisory, Elastic Advisory).

Successful exploitation allows an authenticated attacker to read Fleet Server policy details from Kibana spaces they are not authorized to access, including operational identifiers, policy names, management state, and infrastructure linkage details. The impact is limited to confidentiality — there is no integrity or availability impact. While this does not grant direct system access, the disclosed infrastructure details could assist an attacker in mapping the environment for further targeted attacks (GitHub Advisory, Elastic Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of publication. The EPSS score is approximately 0.025% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated user with Fleet agent management privileges, which limits the attacker pool (GitHub Advisory, Elastic Advisory).

1. Identify target: Confirm the Kibana instance is running a vulnerable version (8.0.0–8.19.13, 9.0.0–9.2.7, or 9.3.0–9.3.2) and that the attacker holds Fleet agent management privileges in at least one Kibana space.
2. Authenticate: Log in to Kibana using credentials for an account with Fleet agent management privileges in any space.
3. Locate the internal enrollment endpoint: Identify the internal Fleet enrollment API endpoint that handles agent enrollment and policy retrieval.
4. Craft cross-space request: Send an authenticated HTTP request to the internal enrollment endpoint, specifying or enumerating policy identifiers belonging to other Kibana spaces.
5. Retrieve unauthorized data: The endpoint, using an unscoped internal client, returns Fleet Server policy details (policy names, operational identifiers, management state, infrastructure linkage) from spaces the user is not authorized to access (GitHub Advisory, Elastic Advisory).

• Logs: Kibana access logs showing authenticated requests to internal Fleet enrollment endpoints from users whose assigned space does not match the space of the returned policy data; repeated cross-space policy queries from a single user account.
• Behavioral: A user with Fleet agent management privileges in one space making API calls that return policy details associated with other spaces; unusual volume of Fleet policy enumeration requests from a single session.
• Network: HTTP requests to Kibana's internal Fleet enrollment API paths originating from unexpected source IPs or user accounts not typically associated with multi-space Fleet administration.

Elastic has released patched versions addressing this vulnerability: 8.19.14, 9.2.8, and 9.3.3. Organizations should upgrade affected Kibana instances to one of these versions as the primary remediation (Elastic Advisory). As interim mitigations, restrict Fleet agent management privileges to only users who strictly require them, and audit existing role assignments to minimize the number of users with this privilege. Additionally, monitor Kibana access logs for anomalous cross-space Fleet policy queries.

Elastic published the security advisory (ESA-2026-25) alongside the patched releases on April 8, 2026 (Elastic Advisory). The vulnerability was catalogued by ENISA under EUVD-2026-20523 and detected by Tenable's Nessus scanner (plugin 305938). No significant independent researcher commentary or notable social media discussion has been observed beyond standard vulnerability database aggregation.