CVE-2026-33461

CVE-2026-33461 is an incorrect authorization vulnerability in Kibana that allows users with limited Fleet privileges to exploit an internal API endpoint and retrieve sensitive configuration data, including private keys and authentication tokens, that should only be accessible to administrators. The vulnerability stems from inadequate authorization checks in the endpoint, which directly returns full configuration objects without enforcing the same restrictions applied by dedicated settings APIs. The vulnerability carries a CVSS score of 6.5 (Medium), indicating moderate severity. It requires network access and low-level user privileges to exploit, with no user interaction needed. The attack has high confidentiality impact, exposing sensitive authentication credentials and configuration details, though it does not affect system integrity or availability. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is readily available. Community attention appears minimal given the low EPSS score of 0.0006, suggesting the threat landscape interest is relatively low at this time.