CVE-2026-33458 — Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

CVE-2026-33458

Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure PUBLISHED

Description (CNA)

Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 9.3.0 through 9.3.2

CWE

CWE-918

References

https://discuss.elastic.co/t/kibana-9-3-3-security-update-esa-2026-28/385815

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.