CVE details
CVE-2026-33460
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/kibana91 | kibana91 | 9.1.10 | unaddressed | elastic@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>kibana91</name>
<range><lt>8.19.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Incorrect Authorization (CWE-863) in Kibana can lead to cross-space
information disclosure via Privilege Abuse (CAPEC-122). A user with
Fleet agent management privileges in one Kibana space can retrieve
Fleet Server policy details from other spaces through an internal
enrollment endpoint. The endpoint bypasses space-scoped access
controls by using an unscoped internal client, returning operational
identifiers, policy names, management state, and infrastructure
linkage details from spaces the user is not authorized to access.</p>
</body>
</description>
<references>
<cvename>CVE-2026-33460</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-33460</url>
</references>
<dates>
<discovery>2026-04-08</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>