CVE-2026-33462
Path Traversal in Kibana Dashboard Management
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | kibana | * |
| elastic | kibana | to 8.19.16 (exc) |
| elastic | kibana | From 8.19.0 (inc) to 8.19.16 (exc) |
| elastic | kibana | From 9.0.0 (inc) to 9.3.5 (exc) |
| elastic | kibana | From 9.3.0 (inc) to 9.3.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Kibana to versions 8.19.16 or 9.3.5 where the vulnerability is fixed.
If upgrading is not possible immediately, restrict dashboard creation permissions to trusted users only.
Additionally, limit the Analytics > Dashboard > All permission to reduce the risk of exploitation.
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in Kibana's dashboard management functionality. An authenticated user with limited permissions can create a dashboard using a specially crafted identifier that includes path traversal sequences. When an administrator later tries to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint. This redirection can cause unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform the delete action on the malicious dashboard.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized deletion of user accounts or other critical resources within the Kibana environment. Since the deletion request is redirected to an unintended internal endpoint, it may cause loss of important data or disruption of services. The impact depends on an administrator performing the delete action on the maliciously crafted dashboard.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reviewing Kibana audit logs for suspicious dashboard deletion events or identifiers containing path traversal sequences.
Specifically, administrators should look for dashboard identifiers that include unusual path traversal patterns, which may indicate attempts to exploit the vulnerability.
While no specific commands are provided, monitoring and searching Kibana audit logs for such suspicious activity is recommended.