CVE-2026-33462
A path traversal vulnerability was identified in Kibana's dashboard management functionality.
Published May 28, 2026 · updated Oct 14, 2026 · elastic kibana
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 28, 2026 · NIST NVD
Detected
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in th
Oct 14, 2026 · NIST NVD
Updated
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in th
Affected
- cpe elastic/kibanaversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33462
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-33462
30-day exploitation probability 0.2%
first.org - NIST NVDVulnerability recordCVE-2026-33462
A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through
nvd.nist.gov