Kibana Path Traversal via Dashboard Leading to Unauthorized User Deletion (CVE-2026-33462)

Vulnerability Overview Vulnerability Name: Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts Description: A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions can create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard via the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to execute the deletion operation on a maliciously crafted dashboard object. Affected Scope Affected Versions: - 8.x: All versions from 8.0.0 to 8.19.15 - 9.x: All versions from 9.0.0 to 9.3.4 Affected Configuration: - Kibana instances where non-trusted users hold dashboard creation permissions, and administrators perform dashboard deletion operations. Remediation Solution and Mitigation: - This issue has been resolved in Kibana versions 8.19.16 and 9.3.5. For Users Unable to Upgrade: - Restrict dashboard creation permissions to trusted users. Limit permissions for Analytics > Dashboard > All to authorized personnel only to reduce the risk of creating malicious dashboard objects. Additional Information Severity: CVSSv3.1: Medium (4.6) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L CVE ID: CVE-2026-33462 Issue Type: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Related Topics Kibana 7.15.2 Security Update Kibana 9.3.3 Security Update (ESA-2026-40) Kibana 9.2.8, and 9.3.2 Security Update (ESA-2026-37) Elastic Stack 6.1.3 and 5.6.7 security update Kibana 8.19.14, 9.2.8, 9.3.3 Security Update (ESA-2026-24) Page Content Views: 532 views Replies: 1 reply Footer Information Copyright: © 2020. All Rights Reserved - Elasticsearch Trademarks: Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries. / Trademarks / Terms / Privacy / Brand / Code of Conduct Other Trademarks: Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana Path Traversal via Dashboard Leading to Unauthorized User Deletion (CVE-2026-33462)