CVE-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

Medium 4.3 Published 8 Apr 2026 Updated 9 Apr 2026

A user with Fleet agent management privileges can access unauthorized Fleet Server policy details from other Kibana spaces via an internal endpoint.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33460?

CVE-2026-33460 is a medium-severity missing authorization vulnerability in Elastic Kibana, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.

Weakness: CWE-863

Which versions are affected by CVE-2026-33460?

2 open source packages ship an affected version, including kibana and elk. It affects 1 product.

Package	Affected	Fixed in
`kibana` Bitnami	From `8.0.0`	`8.19.14, 9.2.8, 9.3.3`
`elk` Bitnami	From `8.0.0`	`8.19.14, 9.2.8, 9.3.3`

Products include Elastic Kibana.

How do I fix CVE-2026-33460?

Upgrade kibana to a fixed version for your release line: 8.19.14, 9.2.8 or 9.3.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33460 being exploited?

There is no known exploitation of CVE-2026-33460 in the wild and no public exploit code.

All Elastic Kibana vulnerabilities

Sources

Also known as BIT-elk-2026-33460, BIT-kibana-2026-33460, GHSA-998c-7hf5-g249, MINI-3v6j-2wv4-f7v5, MINI-5gg2-q2v4-rg3g, MINI-f45w-5xvh-vv7r and 3 more.