CVE-2026-33460
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Incorrect authorization in Kibana allows a user with Fleet management privileges in one space to retrieve Fleet Server policy details from other spaces via an internal enrollment endpoint that bypasses space-scoped access controls.
Risk Assessment
The organization risks cross-space information disclosure, exposing policy names, management state, and infrastructure details to unauthorized users.
Recommendation
Upgrade Kibana to a version with fixed access controls on internal endpoints. Restrict Fleet management privileges to trusted users only.
Original NVD description (English source)
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122). A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoint bypasses space-scoped access controls by using an unscoped internal client, returning operational identifiers, policy names, management state, and infrastructure linkage details from spaces the user is not authorized to access.