CVE-2026-33462: Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict which users can create dashboards: remove or limit dashboard-creation privileges from low-privilege/authenticated users so that only trusted accounts may create or import dashboards.
- Compensating control
Instruct administrators to verify the origin and identifier of any dashboard before performing a delete action; avoid deleting dashboards created by untrusted or limited-permission users unless their safety is confirmed.
- Operational
Audit recent administrative delete operations to determine whether any user accounts or other resources were deleted as a result of dashboard deletions; restore affected accounts/resources and remediate any confirmed unauthorized deletions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33462?
The severity of CVE-2026-33462 is medium with a score of 4.6.
What type of vulnerability is CVE-2026-33462?
CVE-2026-33462 is a path traversal vulnerability impacting Kibana.
How do I fix CVE-2026-33462?
To fix CVE-2026-33462, update Kibana to the latest version provided by Elastic that addresses this vulnerability.
What is the risk associated with CVE-2026-33462?
CVE-2026-33462 poses a risk of unauthorized deletion of user accounts if exploited.
Who is affected by CVE-2026-33462?
Authenticated users with limited permissions in Kibana are affected by CVE-2026-33462.