CVE-2026-4498High· 7.7▾ TwilightExecution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index data beyond their direct Elasticsearch RBAC scope via Privilege Abuse (CAPEC-122). This requires an authenticated Kibana user with Fleet sub-feature privileges (such as agents, agent policies, and settings management).
kibana >= 8.0.0, < 8.19.14kibana >= 9.0.0, < 9.2.8kibana >= 9.3.0, < 9.3.3Upgrade past the affected range:
kibana 9.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42399Medium· 6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-42400Medium· 6.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-42398High· 7.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist
CVE-2026-42401Medium· 4.1Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection
CVE-2026-33462Medium· 4.6A path traversal vulnerability was identified in Kibana's dashboard management functionality
CVE-2026-33463Medium· 5.3Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure