CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-33462

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with limited permissions could create a dashboard with a specially crafted identifier. When an administrator subsequently attempts to delete this dashboard through the Kibana interface, the deletion request is redirected to an unintended internal endpoint, potentially resulting in the unauthorized deletion of user accounts or other resources. Exploitation requires an administrator to perform a delete action on the maliciously crafted dashboard object.

Score
4.6 medium
Published
2026-05-28
Links
NVD · cve.org

Matched ports (2)

PortPackageVersionStatusMaintainer
textproc/kibana91kibana919.1.10unaddressedelastic@FreeBSD.org
textproc/kibana92kibana929.2.8unaddressedelastic@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>kibana91</name>
	<range><lt>8.19.16</lt></range>
      </package>
      <package>
	<name>kibana92</name>
	<range><lt>8.19.16</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A path traversal vulnerability was identified in Kibana's dashboard
	management functionality. An authenticated user with limited
	permissions could create a dashboard with a specially crafted
	identifier. When an administrator subsequently attempts to delete this
	dashboard through the Kibana interface, the deletion request is
	redirected to an unintended internal endpoint, potentially resulting
	in the unauthorized deletion of user accounts or other resources.
	Exploitation requires an administrator to perform a delete action on
	the maliciously crafted dashboard object.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-33462</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-33462</url>
    </references>
    <dates>
      <discovery>2026-05-28</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>