BIT-elk-2026-33458

vendorUSosv

Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

view advisory published 2026-04-13Licence: per source

Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-33458US	high7.7	0.23% (13th)	—	2026-04-08
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass ho…

references

External citations — patches, advisories, analysis.

https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-33458WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan