CVE-2026-33458
Last modified
CVE-2026-33458 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | >= 9.3.0, < 9.3.3 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33458?
How severe is CVE-2026-33458?
How do I fix CVE-2026-33458?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33452CVE-2026-33452 is a buffer overflow vulnerability in the Sec…5.5
- CVE-2026-33453Improperly Controlled Modification of Dynamically-Determined…10
- CVE-2026-33454The Camel-Mail component is vulnerable to Camel message head…9.4
- CVE-2026-33455Livestatus injection in the monitoring quicksearch in Checkm…6.3
- CVE-2026-33456Livestatus injection in the notification test mode in Checkm…7.6
- CVE-2026-33457Livestatus injection in the prediction graph page in Checkmk…6.3
- CVE-2026-33459Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
- CVE-2026-3346IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerab…6.4
- CVE-2026-33460Incorrect Authorization (CWE-863) in Kibana can lead to cros…4.3
- CVE-2026-33461Incorrect Authorization (CWE-863) in Kibana can lead to info…6.5
- CVE-2026-33462A path traversal vulnerability was identified in Kibana's da…7.3
- CVE-2026-33463Operation on a Resource after Expiration or Termination (CWE…5.3
Are you affected by CVE-2026-33458?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST